Malware Analysis Report

2025-01-02 09:23

Sample ID 230108-x219eahh5y
Target 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a
SHA256 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a
Tags
lgoogloader vidar 641 downloader spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a

Threat Level: Known bad

The file 75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a was found to be: Known bad.

Malicious Activity Summary

lgoogloader vidar 641 downloader spyware stealer

Vidar

Detects LgoogLoader payload

LgoogLoader

Suspicious use of NtCreateUserProcessOtherParentProcess

Loads dropped DLL

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-01-08 19:21

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-08 19:21

Reported

2023-01-08 19:24

Platform

win10-20220812-en

Max time kernel

86s

Max time network

148s

Command Line

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

Signatures

Detects LgoogLoader payload

Description Indicator Process Target
N/A N/A N/A N/A

LgoogLoader

downloader lgoogloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2728 created 2720 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe c:\windows\system32\taskhostw.exe

Vidar

stealer vidar

Accesses 2FA software files, possible credential harvesting

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2728 set thread context of 4824 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SYSWOW64\fontview.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SYSWOW64\fontview.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe N/A
N/A N/A C:\Windows\SYSWOW64\fontview.exe N/A
N/A N/A C:\Windows\SYSWOW64\fontview.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2728 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 4824 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
PID 2728 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\SYSWOW64\fontview.exe
PID 2728 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\SYSWOW64\fontview.exe
PID 2728 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\SYSWOW64\fontview.exe
PID 2728 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe C:\Windows\SYSWOW64\fontview.exe
PID 3752 wrote to memory of 4900 N/A C:\Windows\SYSWOW64\fontview.exe C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 4900 N/A C:\Windows\SYSWOW64\fontview.exe C:\Windows\SysWOW64\cmd.exe
PID 3752 wrote to memory of 4900 N/A C:\Windows\SYSWOW64\fontview.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4900 wrote to memory of 4536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4900 wrote to memory of 4536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

c:\windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe

"C:\Users\Admin\AppData\Local\Temp\75fcb5d94124e7f3d099d6ac35a1af401bd52d68d6480a231171ae3b4833688a.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"

C:\Windows\SYSWOW64\fontview.exe

"C:\Windows\SYSWOW64\fontview.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\SysWOW64\fontview.exe" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 6

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 n3wiqkw2ivemhhdhbha3c7rgiq6u4ywc.53rnghwng udp
N/A 8.8.8.8:53 t.me udp
N/A 149.154.167.99:443 t.me tcp
N/A 94.130.190.48:80 94.130.190.48 tcp
N/A 20.50.73.10:443 tcp
N/A 13.107.4.50:80 tcp

Files

memory/2728-115-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-116-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-117-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-118-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-119-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-120-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-121-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-122-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-123-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-124-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-125-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-126-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-127-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-128-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-129-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-130-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-131-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-132-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-133-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-134-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-135-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-136-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-137-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-138-0x0000000002B10000-0x0000000002CE2000-memory.dmp

memory/2728-139-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-140-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-141-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-142-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-144-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-143-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-145-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-146-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-147-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-148-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-149-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-150-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-151-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-152-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-153-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-154-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-155-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-156-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-157-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-158-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-159-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-160-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-161-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-162-0x000000000BB20000-0x000000000BE25000-memory.dmp

memory/2728-163-0x000000000BB20000-0x000000000BE25000-memory.dmp

memory/4824-164-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4824-166-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4824-167-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-168-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-169-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-170-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-171-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-172-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4824-173-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-174-0x0000000077100000-0x000000007728E000-memory.dmp

memory/2728-177-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-179-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-178-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-180-0x0000000077100000-0x000000007728E000-memory.dmp

\Users\Admin\AppData\Local\Temp240553718.dll

MD5 44b25d6ac0bccdccb9e9412e0fe85c1e
SHA1 175cf3733360d01184d033c18cefdc5a1e626409
SHA256 581739ae51a7ed197d380b14a29d75d29370241d8ee900a25bb5d04183315c81
SHA512 421ec70f308bb6a1dd716eb181f295d84662e7115543b1ec0142d82765e79e3b5f0040d8bd970d475c891090cf97d155110e05e2729f61a4ed9afd787fd25da2

memory/4824-181-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-175-0x0000000077100000-0x000000007728E000-memory.dmp

memory/4824-207-0x0000000000F60000-0x0000000000F6D000-memory.dmp

memory/4824-206-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2728-210-0x0000000002B10000-0x0000000002CE2000-memory.dmp

memory/3752-209-0x0000000000000000-mapping.dmp

memory/3752-243-0x0000000000120000-0x0000000000181000-memory.dmp

memory/2728-244-0x000000000BB20000-0x000000000BE25000-memory.dmp

memory/3752-279-0x0000000000120000-0x0000000000181000-memory.dmp

\ProgramData\nss3.dll

MD5 bfac4e3c5908856ba17d41edcd455a51
SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA512 2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

\ProgramData\mozglue.dll

MD5 8f73c08a9660691143661bf7332c3c27
SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA512 0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

memory/4900-335-0x0000000000000000-mapping.dmp

memory/3752-337-0x0000000000120000-0x0000000000181000-memory.dmp

memory/2728-343-0x0000000002B10000-0x0000000002CE2000-memory.dmp

memory/4536-345-0x0000000000000000-mapping.dmp