acrstealer | 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47

Analysis

max time kernel
299s
max time network
298s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/10/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 94KB
Sample261031-2243hs1tbs
SHA256 8c1b9b8e72264e27253a7cc14d6f9a560a127ebd9f8bcec81faba94710c19a47
MD5 eba77a34e9b8aa78fce520d1431fc68b
SHA1 215105e2640cd6da8adc1ea9ddafeb08c4d50f9b
SHA512 fa66a42dd71fc862c218777b572f143144a7de0c5d8630061a554e6ebb9ad4557d810e7ca75598254231cb41dec2391c49a362206b8275742b5a5b92ee33417f
SSDEEP 1536:ZaakYDoIhIxHHWMpdPa5wiE21M8kJIGFvb1Cw3/73sJxy+C:FDpSwMpdCq/IM8uIGfN/73sJTC
TLSH
T1A593D541E62DBDDDE508D4310A75E0F25E24EC3176C0A51EA7F37F0629726A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer sectoprat persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

acrstealer

xor.hex

Extracted

Family

acrstealer

Version

4.5.3-alpha1

cachefly.net
data.wickenhollow.cc

Attributes

guids
f1575b64-8492-4e8b-b102-4d26e8c70371

01a03549-2b37-7674-afe7-d0ce54b13db8
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: SectopRAT
SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
trojan rat sectoprat

Detects SectopRAT aka Arechclient2 1 IoCs

resource	yara_rule
behavioral2/memory/1792-386-0x0000000000400000-0x000000000046C000-memory.dmp	family_sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2284 created 3408	2284	explorer.exe	56
PID 2284 created 3408	2284	explorer.exe	56
PID 2284 created 3408	2284	explorer.exe	56

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
99	1068	powershell.exe
103	4936	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Environment\UserInitMprLogonScript = "\"C:\\Users\\Admin\\AppData\\Roaming\\82cbfaaca7cd\\AutoIt3.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\82cbfaaca7cd\\app.asar\""	powershell.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MNO Security notification icon 2E792ACA31206A335F0521ED10C6CFCF = "\"C:\\Users\\Admin\\AppData\\Roaming\\e7b3fa89b992\\pythonw.exe\""	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1068	powershell.exe
4936	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3244 set thread context of 2284	3244	Setup.exe	90
PID 3124 set thread context of 1792	3124	AutoIt3.exe	129

Executes dropped EXE 3 IoCs

pid	Process
3124	AutoIt3.exe
1792	RegAsm.exe
716	pythonw.exe

Loads dropped DLL 2 IoCs

pid	Process
2284	explorer.exe
716	pythonw.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AutoIt3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AutoIt3.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3256	chrome.exe
1352	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3244	Setup.exe
3244	Setup.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2284	explorer.exe
2284	explorer.exe
2284	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2052	chrome.exe
Token: SeCreatePagefilePrivilege	2052	chrome.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeIncreaseQuotaPrivilege	1068	powershell.exe
Token: SeSecurityPrivilege	1068	powershell.exe
Token: SeTakeOwnershipPrivilege	1068	powershell.exe
Token: SeLoadDriverPrivilege	1068	powershell.exe
Token: SeSystemProfilePrivilege	1068	powershell.exe
Token: SeSystemtimePrivilege	1068	powershell.exe
Token: SeProfSingleProcessPrivilege	1068	powershell.exe
Token: SeIncBasePriorityPrivilege	1068	powershell.exe
Token: SeCreatePagefilePrivilege	1068	powershell.exe
Token: SeBackupPrivilege	1068	powershell.exe
Token: SeRestorePrivilege	1068	powershell.exe
Token: SeShutdownPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeSystemEnvironmentPrivilege	1068	powershell.exe
Token: SeRemoteShutdownPrivilege	1068	powershell.exe
Token: SeUndockPrivilege	1068	powershell.exe
Token: SeManageVolumePrivilege	1068	powershell.exe
Token: 33	1068	powershell.exe
Token: 34	1068	powershell.exe
Token: 35	1068	powershell.exe
Token: 36	1068	powershell.exe
Token: SeIncreaseQuotaPrivilege	1068	powershell.exe
Token: SeSecurityPrivilege	1068	powershell.exe
Token: SeTakeOwnershipPrivilege	1068	powershell.exe
Token: SeLoadDriverPrivilege	1068	powershell.exe
Token: SeSystemProfilePrivilege	1068	powershell.exe
Token: SeSystemtimePrivilege	1068	powershell.exe
Token: SeProfSingleProcessPrivilege	1068	powershell.exe
Token: SeIncBasePriorityPrivilege	1068	powershell.exe
Token: SeCreatePagefilePrivilege	1068	powershell.exe
Token: SeBackupPrivilege	1068	powershell.exe
Token: SeRestorePrivilege	1068	powershell.exe
Token: SeShutdownPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeSystemEnvironmentPrivilege	1068	powershell.exe
Token: SeRemoteShutdownPrivilege	1068	powershell.exe
Token: SeUndockPrivilege	1068	powershell.exe
Token: SeManageVolumePrivilege	1068	powershell.exe
Token: 33	1068	powershell.exe
Token: 34	1068	powershell.exe
Token: 35	1068	powershell.exe
Token: 36	1068	powershell.exe
Token: SeDebugPrivilege	1792	RegAsm.exe
Token: SeIncreaseQuotaPrivilege	4936	powershell.exe
Token: SeSecurityPrivilege	4936	powershell.exe
Token: SeTakeOwnershipPrivilege	4936	powershell.exe
Token: SeLoadDriverPrivilege	4936	powershell.exe
Token: SeSystemProfilePrivilege	4936	powershell.exe
Token: SeSystemtimePrivilege	4936	powershell.exe
Token: SeProfSingleProcessPrivilege	4936	powershell.exe
Token: SeIncBasePriorityPrivilege	4936	powershell.exe
Token: SeCreatePagefilePrivilege	4936	powershell.exe
Token: SeBackupPrivilege	4936	powershell.exe
Token: SeRestorePrivilege	4936	powershell.exe
Token: SeShutdownPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeSystemEnvironmentPrivilege	4936	powershell.exe
Token: SeRemoteShutdownPrivilege	4936	powershell.exe
Token: SeUndockPrivilege	4936	powershell.exe
Token: SeManageVolumePrivilege	4936	powershell.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2052	chrome.exe
2632	msedge.exe
2632	msedge.exe
648	firefox.exe
3124	AutoIt3.exe
3124	AutoIt3.exe
3124	AutoIt3.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3124	AutoIt3.exe
3124	AutoIt3.exe
3124	AutoIt3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2052	2284	explorer.exe	92
PID 2052 wrote to memory of 2276	2052	chrome.exe	93
PID 2052 wrote to memory of 5040	2052	chrome.exe	94
PID 2052 wrote to memory of 5040	2052	chrome.exe	94
PID 2052 wrote to memory of 3256	2052	chrome.exe	95
PID 2052 wrote to memory of 4452	2052	chrome.exe	96
PID 2052 wrote to memory of 4452	2052	chrome.exe	96
PID 2052 wrote to memory of 2460	2052	chrome.exe	97
PID 2052 wrote to memory of 2072	2052	chrome.exe	98
PID 2052 wrote to memory of 2460	2052	chrome.exe	97
PID 2052 wrote to memory of 2072	2052	chrome.exe	98
PID 2052 wrote to memory of 2792	2052	chrome.exe	99
PID 2052 wrote to memory of 2792	2052	chrome.exe	99
PID 2284 wrote to memory of 2632	2284	explorer.exe	101
PID 2632 wrote to memory of 3920	2632	msedge.exe	102
PID 2632 wrote to memory of 1352	2632	msedge.exe	103
PID 2632 wrote to memory of 5036	2632	msedge.exe	104
PID 2632 wrote to memory of 5036	2632	msedge.exe	104
PID 2632 wrote to memory of 5036	2632	msedge.exe	104
PID 2632 wrote to memory of 3908	2632	msedge.exe	105
PID 2632 wrote to memory of 3908	2632	msedge.exe	105
PID 2632 wrote to memory of 3892	2632	msedge.exe	106
PID 2632 wrote to memory of 4460	2632	msedge.exe	107
PID 2632 wrote to memory of 3892	2632	msedge.exe	106
PID 2632 wrote to memory of 3892	2632	msedge.exe	106
PID 2632 wrote to memory of 4460	2632	msedge.exe	107
PID 2632 wrote to memory of 4460	2632	msedge.exe	107
PID 2632 wrote to memory of 4836	2632	msedge.exe	108
PID 2632 wrote to memory of 4212	2632	msedge.exe	109
PID 2632 wrote to memory of 4836	2632	msedge.exe	108
PID 2632 wrote to memory of 4836	2632	msedge.exe	108
PID 2632 wrote to memory of 4212	2632	msedge.exe	109
PID 2632 wrote to memory of 4212	2632	msedge.exe	109
PID 2632 wrote to memory of 4792	2632	msedge.exe	112
PID 2632 wrote to memory of 4792	2632	msedge.exe	112
PID 2632 wrote to memory of 1612	2632	msedge.exe	114
PID 2632 wrote to memory of 1612	2632	msedge.exe	114
PID 4276 wrote to memory of 648	4276	firefox.exe	116
PID 4276 wrote to memory of 648	4276	firefox.exe	116
PID 648 wrote to memory of 2940	648	firefox.exe	117
PID 648 wrote to memory of 2940	648	firefox.exe	117
PID 648 wrote to memory of 2940	648	firefox.exe	117
PID 648 wrote to memory of 2940	648	firefox.exe	117
PID 648 wrote to memory of 2076	648	firefox.exe	118
PID 648 wrote to memory of 2076	648	firefox.exe	118
PID 648 wrote to memory of 2076	648	firefox.exe	118
PID 648 wrote to memory of 2076	648	firefox.exe	118
PID 648 wrote to memory of 4188	648	firefox.exe	119
PID 648 wrote to memory of 4188	648	firefox.exe	119
PID 648 wrote to memory of 4188	648	firefox.exe	119
PID 648 wrote to memory of 2552	648	firefox.exe	120
PID 648 wrote to memory of 2552	648	firefox.exe	120
PID 648 wrote to memory of 2552	648	firefox.exe	120
PID 648 wrote to memory of 2552	648	firefox.exe	120
PID 2284 wrote to memory of 1660	2284	explorer.exe	121
PID 2284 wrote to memory of 1068	2284	explorer.exe	122
PID 2284 wrote to memory of 4936	2284	explorer.exe	124
PID 1068 wrote to memory of 3124	1068	powershell.exe	128
PID 3124 wrote to memory of 1792	3124	AutoIt3.exe	129
PID 3124 wrote to memory of 1792	3124	AutoIt3.exe	129
PID 3124 wrote to memory of 1792	3124	AutoIt3.exe	129
PID 4936 wrote to memory of 716	4936	powershell.exe	131
PID 716 wrote to memory of 2464	716	pythonw.exe	132
PID 716 wrote to memory of 2464	716	pythonw.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- - C:\Windows\SysWOW64\explorer.exe
    \??\C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1660
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Badlisted process makes network request
      Registers new Windows logon scripts automatically executed at logon.
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\AutoIt3.exe
        
        "C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\AutoIt3.exe" "C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\app.asar"
        5⤵
        Suspicious use of SetThreadContext
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3124
      - C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\RegAsm.exe
        
        C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\RegAsm.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1792
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$b=[Console]::In.ReadToEnd();$s=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($b));& ([scriptblock]::Create($s))"
      4⤵
      Badlisted process makes network request
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Users\Admin\AppData\Roaming\e7b3fa89b992\pythonw.exe
        
        "C:\Users\Admin\AppData\Roaming\e7b3fa89b992\pythonw.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:716
      - C:\Windows\System32\smartscreen.exe
        
        C:\Windows\System32\smartscreen.exe
        6⤵
        
        PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff910f1c728,0x7ff910f1c734,0x7ff910f1c740
    3⤵
    PID:2276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,7551148156397445000,4632978860339259954,262144 --field-trial-handle=1984,i,17282397717608729564,12775854531906362750,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1980 /prefetch:2
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1672,i,12806427595716877096,18162074309876874947,524288 --field-trial-handle=1984,i,17282397717608729564,12775854531906362750,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,17209731398519218854,6164310806377737251,524288 --field-trial-handle=1984,i,17282397717608729564,12775854531906362750,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:4452
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,966315458925589866,6562294884648719211,2097152 --field-trial-handle=1984,i,17282397717608729564,12775854531906362750,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3204 /prefetch:1
    3⤵
    PID:2460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,10240285535838528618,2541316075533990451,2097152 --field-trial-handle=1984,i,17282397717608729564,12775854531906362750,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,16381992040562961754,14801643617849155078,2097152 --field-trial-handle=1984,i,17282397717608729564,12775854531906362750,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4260 /prefetch:2
    3⤵
    PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff90d21c188,0x7ff90d21c194,0x7ff90d21c1a0
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,166819356991654207,3038388136218374885,524288 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,6695162471267381566,784037637137533306,262144 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,7175993394645450296,15203500219547599743,524288 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:3908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,659529050131977182,104872260541992392,2097152 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,4625240622916208126,16548678745452409109,2097152 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4068,i,15160586265443306021,14612099555567312306,2097152 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,4821958525001483788,11491292331814611307,2097152 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:2
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,974006014307909047,736281345335908881,524288 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,10634951672645386477,6547098379678538053,524288 --field-trial-handle=2872,i,4157896793412020280,454545194101038158,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:1612
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile "C:\Users\Public\.ff_tmp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless -no-remote -profile C:\Users\Public\.ff_tmp
    3⤵
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2800 -prefsLen 24448 -prefMapHandle 2804 -prefMapSize 268500 -ipcHandle 2880 -initialChannelId {6edc9a01-9738-461e-a443-229a34c60647} -parentPid 648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:2940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2108 -prefsLen 24658 -prefMapHandle 2012 -prefMapSize 268500 -jsInitHandle 2016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1828 -initialChannelId {ff5a9c3a-7f8e-4b1e-96c7-74f66e13d0d6} -parentPid 648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:2076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3788 -prefsLen 25545 -prefMapHandle 3792 -prefMapSize 268500 -ipcHandle 2016 -initialChannelId {6991ba12-df2e-428c-bd5c-115a9842ebde} -parentPid 648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:4188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4272 -prefsLen 25607 -prefMapHandle 4276 -prefMapSize 268500 -jsInitHandle 4280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3708 -initialChannelId {5f7138c5-2288-4f84-be2b-46f734bd5978} -parentPid 648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:2552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update-config.json

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Size 102B
SHA256 ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
MD5 7d1d7e1db5d8d862de24415d9ec9aca4
SHA1 f4cdc5511c299005e775dc602e611b9c67a97c78
SHA512 1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
TLSH
T12BB012800100B658F0FC4CCC05303B3E0248402D44CF3903004D30A0787B0020A094FE
MD5 SHA1 SHA512 TLSH

Submit Download

4a4ce5bb-2d74-4dde-8b97-406fc12ecae3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4a4ce5bb-2d74-4dde-8b97-406fc12ecae3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e61f0e60-07d9-4547-8238-b27220db5070.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e61f0e60-07d9-4547-8238-b27220db5070.tmp
Size 131KB
SHA256 5c6c6330e1a99e3e89a3c41e32a8500f81082b07b180b4222d04759f941ecd36
MD5 7506dd81813bc33ba49d44a6e4250e32
SHA1 00991131a55ef0361dcab1df2ba0ff73e21557fb
SHA512 7f53e3fa31312aa8d14826ecbc970a001f01266fa747c2e244a8c56ad7826e9ca1d460dd924e01e6c5ab4d38322787e611cce4d232a2b1b3aa55d42e72ba49f5
SSDEEP 3072:d3IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzW:d/Ptbmf1K49XLWbEPi4NTKlLzW
TLSH
T1ABD312217D01BCB4E9AEDB21B2902A15EAB8D94B95393FE61CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3e2b0c2bb6d912d84ce48cd630139460570d4d0cd3a24f8734458aaaef7a80e4
MD5 ffed04eb410ce8cf04b83b315f56e750
SHA1 e8ef72e04b6753288782a8d3beddb830121cc99b
SHA512 ba55c082a04e526973f4a22468e06635cc90964f5038be373f564ac212e87abdb6ccf26121360666fd3c38e15ddd17e705e9f84dd6911c397ac4de22a5e0766c
TLSH
T12681CD323375A0E4C9667F07192C19C063AF4396EA98AF5CB25C521EE92751BDB122F3
MD5 SHA1 SHA512 TLSH

Submit Download

0ceda80a-6750-4e21-8e0c-f5e8cab2979c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ceda80a-6750-4e21-8e0c-f5e8cab2979c.tmp
Size 8KB
SHA256 a8e149505a5612991c76b7f41e8d90b1724afe71b6b27947d0895a95b5b2fef6
MD5 b81b2d01eec7450556a1c94a5e09d81a
SHA1 c1f2eda27d5bb7428c8ec5bc4d88a263609eb08f
SHA512 ed70155aa0824aeab5ca15cabdfe836743d2bb07ff534891e0b43827503acc4f29b0cbdc6159c829ec2065a60a16a773eaa1c83e6e6465425fc1c0e692c2c430
SSDEEP 192:fON968+PQmiUy5o/GCaX/QujzobYzNX2QYLqvWU6:fON96BRF/GCaXIySSNXkoWU6
TLSH
T1C112FB359D787C675FE3AE55B08B3B139FE4512BA6845F54EEE80A2C00D725C230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67eec63ac68fbb0c1370804e730eb2380e37e239eeab08ad3acdbce09f2d4da7
MD5 01c96e75e4fea28f5b0070be7d2642b1
SHA1 2bf70d62314d343b1de12a799097bd6bdeda356e
SHA512 ba15fbcf47b54f0dd13d6c3fe38c3aaee1e1084d8dfdb2fff0655289696d4edfd95df9f4d568129ce17fbb46e9d8dc819a710205be11e86776404ec9304c340e
TLSH
T116D02474D3300531F0154073FF1507440D05C50C0717010DC03050DF5CD01544101040
MD5 SHA1 SHA512 TLSH

Submit Download

226cd55f-39be-4b22-b736-5636281e96e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\226cd55f-39be-4b22-b736-5636281e96e5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd51bcba-d84a-45b9-af4f-a13dd4c86f76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd51bcba-d84a-45b9-af4f-a13dd4c86f76.tmp
Size 8KB
SHA256 60645ff234fbda88ebf4f9f26a20e18ccfdc7c2cb5bcce504f1dd3abcf38429b
MD5 6f117f4cdf0f42d2ef48e517e792fed7
SHA1 d10f3e4169a02650cd3d2b6c86bf96ea7489d3f5
SHA512 8571b125a1b3d750646518cc0c3e492fb2d9f2f7d0b85f6e8b34eeeee917d729ad008f67961fb0363049b765e1622593db582399114a887dd19ab8e803bae1c1
SSDEEP 192:SONX68+7QmiUySo1GCaX/QujzobYu0LpbfU6:SONX6Bts1GCaXIyS0RfU6
TLSH
T14202E939AC787C6B9EE3AE45B48B3B179FD4103BA6D45F54DAE80A2C00D724C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 10e9ccd59d9d637017abda1425ca64dee636a1011a817c173ca854bc5fe2e471
MD5 279de9c02e4465971808b4db58aae4ca
SHA1 23435520a20b505ea0608638970db98b6ccf9c48
SHA512 c52e2469051b4c229125370b11eaab60d92a75905972e25b119ba24ac6dd17ee9b6e4387d11e897a6627f299d4adf49c7bd10fb2b550cb10caefa206b8f55988
TLSH
T13F318627B3E9C5D3DC89013B109C9D6076A6D7C7809ECFDB2A84D619B47F698DB20354
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hgkq210x.kcz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hgkq210x.kcz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 559KB
SHA256 489ebb0760ac61e45cc6bb014d6177ff0c741ee92d37dd82a658d6ab00f8634b
MD5 72638d1d000b715cf61aa25cd54149df
SHA1 317256fde95202cc7c34aeb65cedb982ea3ecf2f
SHA512 79d329f0cf7f6c37a531a49b6025404098de833241c1c614351226cf761770010e615b073109ac6f9013deaf27c8297db53c22f6ddc784f91c5d55433f631f49
SSDEEP 12288:uhRe6rXczIdllPnaE6gzqtDa/bCOx7a63seVVscLvD2atJaiaW4nedwJ71u11Xvr:uhc6jczkQE6gzqZa/bCORjFfvrJrmjmt
TLSH
T140C401FAF7617CE3A7BE030B9D8A7EAD1B624122878EE0CC447767C24557729AF64404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoIt3.exe

Path C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\AutoIt3.exe
Size 1.1MB
SHA256 5d69a932a077fee044b193c28e84564143f5c7e51079ab48e88fef74ab0b77b7
MD5 80cdd5f19d704a001589976bae277bab
SHA1 96bb030389ac938c5ebc6bd2e9fcc86a10e5f2fd
SHA512 03fbfd02d348c2b54af3eeb022ae2f1be4e4f9b30352ceb2c7589233275a914ec4fd81ff8c1544bebf96a87e28c75fd81811e658f092536367395048a82bf8fa
SSDEEP 24576:HsTBc4JYoji1a2gOI6fQJ77jkD1KV3wKct4frNFOB:MTC4a4p+E72SwRcrK
TLSH
T1DA356C0673A4419EFEA7F1329607C60BD6B17C4A07779A6F02646B626F337711A2E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\RegAsm.exe
Size 63KB
SHA256 dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a81
MD5 a4eb36bae72c5cb7392f2b85609d4a7e
SHA1 5c58053a3a18c0226b98a4ac7e7320581300b6c9
SHA512 8ebdd20b7c1ee87aa3766d812960b0d8cfa0a6ba6e371f730e589895d202dd540eb475f69940261c1532e90d1030370e9eb5102cadbf6e546f99b350de79b95a
SSDEEP 768:/8XcJiMjm2ieHFYPyCsSuJbn8dBhFwjSMF6Iq8KSYDKvc7qWk81:zYMaNyFYPYSAb8dBnWHsPDKvcN91
TLSH
T1D353E714A7E84216F6FB4B71AEF5C4479936B593AD65C34C248D438D0B223C1DA23BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Roaming\82cbfaaca7cd\app.asar
Size 1.0MB
SHA256 5b6e971609d520d394b77ce8bfaac7d2ca52883e74921086345d6c08904577b9
MD5 ae9c1fbba8abbb5d4c3ae15fad2469b7
SHA1 41548a4618bdc4bc46b13cca87ba465ac64c908b
SHA512 5d33df2a2a1331d747b02cb31947cd6a681a0510d54a5cc0912c0ed56076467046dc26a2ad9b1a49c3c0d0474d1ddc9472eb217559b949ee8ecdb5849a99db39
SSDEEP 24576:B89DekHtrBTohm0s+VcmdlCEzRC0IEV7OHbtB+Aiog:B8UT0wVBz7ABEVyP+B
TLSH
T1B435332F214071EB6E40D76A4CB387F919AF2027C1CD5BAA120D513A9E2647EE4BFC95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_pyexpat.pyd

Path C:\Users\Admin\AppData\Roaming\e7b3fa89b992\_pyexpat.pyd
Size 46KB
SHA256 a5c3b69ded09f412b0492a08d41a546ab3854a320b67b650631896c811feb662
MD5 41aad642d30541fa0ed61050490a6016
SHA1 0909d13085fbdc5259739afe88b3067507407d7c
SHA512 fe6eb8b822a74a25b97a1ded299d879813d6b61c2aee10f09746542eb41ab6ee96be72dec3ea37f2af22571dba0dca9b2e7d2e1fb08dedeccd078d1746ea759a
SSDEEP 768:8FuwOUfBpvvoNnJyUDksU/mBGqXETFFFH0nlGqkzSpbp2lrKFSKmh+u/:sOUfBQJybmBGqUTFrqGqjpbp2ZOSKmN/
TLSH
T1BA23F140EF314A34DA4F289DE77A54FB29609B42EDAF30718F3B3A31B55122AE0956C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Roaming\e7b3fa89b992\python314.dll
Size 2.2MB
SHA256 5aac2dba36ccbf6fafe4f58d4cc66d6ba262c12ff2f9c21ee73ff2e5a1e4137f
MD5 9277ef8fdb7a04c8e78a92115592960d
SHA1 1145c3a83e163ae2a09fca90fb3d4b7155687f8a
SHA512 6e7266d0aadaec0c81de5bc6f51025cae9c3e484c6a471f44d7538199dad2f6ad0708269cf2b3c03c805f49fbb25b50180746ae4914e200c9d7de3b6f062f1f2
SSDEEP 49152:jP/SexSTJTLd/xzbU+YgXOxrdBzBWhf6sNT8nep2m1zcfWinFNLVnN8r15yNx2mN:wOxY7RtwLOGGw/Y
TLSH
T1B0B56C0E7507C660E99164359C05E9EAF6B83E078DAB582B75F3373F29BBC82134AD41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Roaming\e7b3fa89b992\pythonw.exe
Size 102KB
SHA256 4e24680bce514188c85ae91323691dcb0364990da0d6319558519e50cbb5a43c
MD5 c60e1f073035fb947a762111d2ae5d9c
SHA1 f658e8cf75487524696111332ad7d9972484abf2
SHA512 7f97fea994132da15692bb21553f9ab40139de76cb6c472840513d02537091bdbacfae6c74aa20d3583d37f7b465817c49602c6f6e9c64a9cd886f3b593a6cc7
SSDEEP 1536:1ZX7CIxHHWMpdPa5wiE21M8kJIGFvb1Cwb/94sqyb2QS9NfIY+uFn:1ZLBwMpdCq/IM8uIGfB/94sF5En
TLSH
T1F2A3F741E62DBDCDE548D0314A75D4F26E24ED727580A11EB7F77F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Public\.ff_tmp\activity-stream.contile.json
Size 4KB
SHA256 cceb632e079fa63222f150d9f6549820e6e2b2ff32c6aff36be0509e5da5daee
MD5 20a879c31c540318d6c83303db824846
SHA1 24d09f6a5add13fff76885a6aab6a0afb08c4b2b
SHA512 e9fd7d5579962bc4bdafbe5cdee8f370cd972637575d46d9cf4e276884f09f00664be56d698fdb26a9dd527558b03c90d34ab948d8a1b68c7c969290dd8c2792
SSDEEP 96:TfVlMFMIV3mtpSnKT+mRpKV8nnJRlAUiJVhlz:XM9Brn3mR4eGUAXF
TLSH
T117A1D95F897488261731A6E57C0B278CF10B780599F1C6FC72699C60965C3FAD1D6C88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 74KB
SHA256 4352a8aa176ca9d9e890a8470989799f919fa6162a1e2373c9357422672b5ac9
MD5 2ac5d36bd10b2664a23a34479bdee7d9
SHA1 d0385fc1a5acf8e47fb4d6ff9fcd89bbdc279efa
SHA512 8b98b03a065076813723cc64dcd54ba8a529c766ee0c3f04f7ac7df6cb740161bf92a6fd4d29329417790fab415a3dc8c759ffe8e646b6a4addf2745332ecf8a
SSDEEP 1536:7kDk08A/zI4SZZqzB5xsjvxB88PzrMMMQMm:7RaGZZqZsvtX
TLSH
T17A7318A392A8F1FF0F9177CB2C4B7A5B66D21195E74501C8ECEACA0C81CC754523E6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Public\.ff_tmp\activity-stream.discovery_stream.json
Size 1KB
SHA256 52db944c0ae0b33a0e3a69ac201fa7e22b410900dae8025c73d5da1d3e6286ef
MD5 91f8336c581802f6aace6dc0106bacb7
SHA1 d60f72df5800d8b2fb1d090e85db4061044b71b8
SHA512 2e7e5fab16bfb33f6a585318547eba1c1d07de5ab544450916e4bd8d393e2281cc01e59bcd238b60fa999e780f808e47a0bbb29a61117a03985ad5f9147354b0
TLSH
T1D8213778184C1931E5B5781A2A4FF701CAF1F256DA50AF6CDAA91D284CC74F4936152F
MD5 SHA1 SHA512 TLSH

Submit Download

state.json

Path C:\Users\Public\.ff_tmp\datareporting\state.json
Size 175B
SHA256 84a8c655c511efec9a841f5278d740668c1f62df0ebbba846e7997d43695faa6
MD5 0dc917ed68c62970dd3796fe0b25e94d
SHA1 22829545099212af876bf5f4f49eb1aff466a9b1
SHA512 e018ee1e50173b6b79ec9a19b508125dc6df99e5fb3f904227d4be41804e6f814f807ea927fdccb18bc03ba33678facdc983479785c28e9028a9536ef12cdb6a
TLSH
T13BC080434ECB447350E25B01214B10644B7C95351D83E360664C511CA7DB65F05FF285
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Public\.ff_tmp\extensions.json
Size 9KB
SHA256 d864a129f3e839f468c4b5bb34f1ffd658e87d06b8df6bd55cc6f9c475e2b7a9
MD5 f4ccb44d11e46431c26a3dbf88c9e487
SHA1 53be72c5d48b37dd2e6e5a12f151eeef951ccc80
SHA512 916a8a88f49f817c5650b0fed6c7f715df745b670177aae35e3d36a48c2337e002925abf2db567d1455e8dafd9fdff1e426510372d9043aee0b78c836e3caba6
SSDEEP 192:O6kI4vGUmldvo8dhEp0943D396gDMjL4kY3:O6kI4vGUmldvo8dhW094z396owL4H3
TLSH
T17B12651549048EB8294EA79BBB367D02D37D473B60845C38B4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Public\.ff_tmp\prefs-1.js
Size 5KB
SHA256 f78fdf5837e00d5bded817c965a12f4d49a9dbd3b31edc72bbf0bdbb78f1a9ef
MD5 83b11c5e5773f21e0621f513bd1a3856
SHA1 ae0cfecfdc56f5fd16a0d22df254e12a5856d1fd
SHA512 8ecc15afacc53069d3596dd0169aa8764805c6b28bdd8c5b0b987f0020eef8f60f2294cbcd30df221b760f6dd6960b924248ab3efba946c55c692806497092ea
SSDEEP 96:xHY9UQqGqXfnzv9mK6El09j9nUUHyRBw8hVcnT1:iSRXfRmK6EjSMBw8hK1
TLSH
T169C100385548CB7F74B6776CAC6488319AB2413BB7BF68D650E54484050CF3892F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 2KB
SHA256 12b36a49804538bb83ffc80f22e442ea905962ac0b8485860c37566b6422573e
MD5 438bb40f9cebd92df523bb138a06a0d3
SHA1 ee6f3cf3c129a4343bf98fc828d8257f75eb28bb
SHA512 b932ae2f9d8e04fc2f970885475f0a1a9d75f12461837624067df1f834ed73a5e416e3f07b1e48d454e2b9f18e7b8bd467337406f41b3169c690866c5ef8802d
TLSH
T19041DC7955448F6FE8F9736CBC1445729EB2817BB6BF289220E48084050CF7816F6AD7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 3KB
SHA256 e1032aa8d27dabe5d342471bf4df3c57b48d007f032d3211eb1dc42915294514
MD5 ee36d8345e5610eaaf57a167bc856626
SHA1 dad007f968c85a05895cee2897c5a17f35166424
SHA512 fb46b6fcf3c96340191caf5926e885b6cde0ff82204682e122768f6360b9c556f425302691d061c336f0fd6a41139b849518814f17867c9f965382c352e8e2ef
TLSH
T1C8710C796504CF6FB4F677ACBC658871AAB2017BB77F289210E880C4400CF3856E9AD7
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 5KB
SHA256 d183c8f96876dc34abde1189bf24c6a71b0bd59cb9be0d0412029b103376c21d
MD5 18d4845f945e1e32c636fffeb8cdcce2
SHA1 50d9a1877f3ce14e52da2f63ec5b4edbcc3008d9
SHA512 015a9c7d07157522887ad5766733c221bcd1da3c4cbeb844ee1f782f3b253a261096db53cbca69bd061d6064eb6fe9207970f2ba86831564fad54043245b9ef3
SSDEEP 96:xHaEqGqRdnzvN6ElU9hnUUHyRBw8hVcnT1:s3RRdh6EXSMBw8hK1
TLSH
T11AB11F786504CB7F74F6776CAC648C319AB2013B77BF68D660E584C40508F3846E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Public\.ff_tmp\prefs.js
Size 4KB
SHA256 a21045964e9b3004ec650897da064f0793449f8e4cd5765c92b76808163bf2a0
MD5 a8924284e4fa34f939c3e6b1eaf9ea39
SHA1 cf101faee508eae583fb1d9eb677843f5b2b5890
SHA512 2235fc74d444257240dbe305c398400ce5c8e7a8b1e26b7866aae26922c3bcb76859150d22476485173e98bfc9714139eed9e56d7175720f066d993c99bea537
SSDEEP 96:xHaEqGqIdnzvN6ElW9hnUIY21w8hVcnT1:s3RIdh6EZI71w8hK1
TLSH
T17EA11E786544CB6FA4F6777CACA48C715EB2017BB7BF288610E984C4410CF3846E9ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Public\.ff_tmp\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 48KB
SHA256 a7bfc084b6a77b7ffe72e57bdcccbbec0a03368d5cda627b32773ca2b8e503d7
MD5 f7c9bd630274979e357295ff83e9ea4f
SHA1 9522b51c6911131d076f65f0d8ccd7e29c205fa9
SHA512 c348972227fbd710c1db272c51aa9b8cc92cf8f3bd56240cc1e4d156d092aae57d286a631203bcbff2bab140bea478d7fbd7a80aaad64e8b1a15aefdc0b245f7
SSDEEP 96:Oa16S6CKnqlizbxV+2xVeU7X2B0KZMNXCL23Cfi2f6E2A/2g42cRCH2ZC0H7mh9:Oa16S6CdFAWLyh44CfiaR/skL0H7
TLSH
T1E923548D3A33AD50CB29F0B8639145AA584FB1DD0030278965D9DF8C842B1ABED1FBF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Public\.ff_tmp\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 167277786854c08507283a8b1781db2ff2044582963efbccf124ac46ebaf7c12
MD5 64c742efc6aac13c1faae4b33b614fce
SHA1 a3a000f8d688344de6bb0047accdc1538cf51363
SHA512 1ce8a8dc5702bea420a98a015de03f7d8adbb04a1afbea24f7070336de9094dd6403b1ce6627e2317af2226550795835203e059b180f2b9cdd155b05fe9b6bdd
SSDEEP 768:N6S6CrAWYj+f3aY3p6x3I0H7/29fUcHLeHnHf:N6S6fy3aY3p6x3L8UcHLeHn/
TLSH
T18B43A6CA3633DD51CB29E47E62A642FB544FA2DD003113886A9E9F4C441B5979E2FFE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dvr_eea90ca99c402e30.tmp

Path C:\Windows\Temp\dvr_eea90ca99c402e30.tmp
Size 712KB
SHA256 d394e5879b2250375c61c2c9a97e50a909fe8554b5f0ba6b056c22083668eda0
MD5 044a2bc1c7920158b8cc8a3f0c758d0c
SHA1 9bed2fead6ba25f066b84128b130fc5d3fec7d6e
SHA512 bf9c7d08375a029bc6dab120aef95d19e51144631c7df1aa553976333ba0b3621be85eb0afe27d87c9a754af4c56244b7d813b94e8677b6b6efc656c234e350e
SSDEEP 12288:Of4jI5T2gbWdwFF59vIA4CKLssms2TusH3dBobStc:rOqgbBz5qbCyssZ2T5XdDq
TLSH
T145F412CBF7D609ABA7CEDDE270B23AE137A140BCC51B3A354AB6B029108774D7B54254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-364-0x000001F1AFE20000-0x000001F1AFE4A000-memory.dmp

Download

memory/1068-365-0x000001F1AFE20000-0x000001F1AFE44000-memory.dmp

Download

memory/1068-363-0x000001F1AFDE0000-0x000001F1AFDEA000-memory.dmp

Download

memory/1068-345-0x000001F1AF150000-0x000001F1AF172000-memory.dmp

Download

memory/1660-336-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/1660-335-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/1660-337-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/1660-330-0x0000000001410000-0x0000000001413000-memory.dmp

Download

memory/1660-331-0x0000000003750000-0x0000000003D22000-memory.dmp

Download

memory/1792-385-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/1792-390-0x000001E25B280000-0x000001E25B2F6000-memory.dmp

Download

memory/1792-389-0x000001E240570000-0x000001E2405C0000-memory.dmp

Download

memory/1792-388-0x000001E25B450000-0x000001E25B612000-memory.dmp

Download

memory/1792-386-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/2284-329-0x000000006B000000-0x000000006B0DC000-memory.dmp

Download

memory/2284-12-0x000000006B000000-0x000000006B0DC000-memory.dmp

Download

memory/2284-13-0x000000006B000000-0x000000006B0DC000-memory.dmp

Download

memory/2284-14-0x000000006B000000-0x000000006B0DC000-memory.dmp

Download

memory/2284-355-0x000000006B000000-0x000000006B0DC000-memory.dmp

Download

memory/2284-16-0x0000000077D43000-0x0000000077D44000-memory.dmp

Download

memory/2284-328-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/2464-423-0x00000174E3980000-0x00000174E399C000-memory.dmp

Download

memory/2464-422-0x00007FF728CC0000-0x00007FF728F0C000-memory.dmp

Download

memory/3124-384-0x000002AC241F0000-0x000002AC241F1000-memory.dmp

Download

memory/3124-383-0x00007FF92E830000-0x00007FF92EA28000-memory.dmp

Download

memory/3244-6-0x0000000002D00000-0x0000000002DA8000-memory.dmp

Download

memory/3244-5-0x0000000002D00000-0x0000000002DA8000-memory.dmp

Download

memory/3244-0-0x0000000002D00000-0x0000000002DA8000-memory.dmp

Download

memory/3244-7-0x0000000002D00000-0x0000000002DA8000-memory.dmp

Download

memory/3244-8-0x0000000002D00000-0x0000000002DA8000-memory.dmp

Download

memory/3244-17-0x0000000002D00000-0x0000000002DA8000-memory.dmp

Download

memory/4936-398-0x00000271FF450000-0x00000271FF462000-memory.dmp

Download