8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
27-11-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

02c70d9d6696950c198db93b7f6a835e
SHA1

30231a467a49cc37768eea0f55f4bea1cbfb48e2
SHA256

8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
SHA512

431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
SSDEEP

12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation	Bootstrapper.exe

Loads dropped DLL 11 IoCs

pid	Process
2528	MsiExec.exe
2528	MsiExec.exe
2032	MsiExec.exe
2032	MsiExec.exe
2032	MsiExec.exe
2032	MsiExec.exe
2032	MsiExec.exe
4420	MsiExec.exe
4420	MsiExec.exe
4420	MsiExec.exe
2528	MsiExec.exe

Unexpected DNS network traffic destination 47 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Blocklisted process makes network request 2 IoCs

flow	pid	Process
40	1112	msiexec.exe
42	1112	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\socks\docs\migratingFromV1.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\delegates\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\classes\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man7\scope.7	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\depd\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\winchars.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\event-target-shim\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\lib\abort-error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\has\src\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cidr-regex\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-ci.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-prune.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npx-cli.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\x509\asn1\dump.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fs.realpath\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-query.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\dir.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\CHANGELOG.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\infer-owner\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-install.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\archy\examples\beep.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmpack\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\chownr\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\events.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\lib\find-node-directory.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\.npmrc	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-cache.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-uninstall.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\https-proxy-agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\google\protobuf\descriptor.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_bundle.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\metavuln-calculator\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\utils.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\git\lib\make-error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-run-script.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\reset-dep-flags.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\yallist\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ssri\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\calc-dep-flags.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\glob\glob.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\is-windows.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cmd-shim\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ansi-regex\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\@npmcli\fs\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\node_modules\brace-expansion\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-normalize-package-bin\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\npm-bundled\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-logout.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-unstar.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-install-test.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\configuring-npm\npmrc.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\columnify\utils.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\encoding\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\safe-buffer\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\tools\graphviz.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agent-base\src\promisify.ts	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF14B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1205.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI191C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA45.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF15C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE399.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE409.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA74.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1168.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13DB.tmp	msiexec.exe
File created	C:\Windows\Installer\e57dce3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57dce3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e57dce7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE840.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3164	ipconfig.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\npm	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\PackageName = "node-v18.16.0-x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\PackageCode = "347C7A52EDBDC9A498427C0BC7ABB536"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Version = "303038464"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\NodeEtwSupport = "NodeRuntime"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\corepack	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B532AFE1A6C6E24B99C208A5DF6C1CD\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\ProductIcon = "C:\\Windows\\Installer\\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\\NodeIcon"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2968	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe
2968	WMIC.exe
5032	Bootstrapper.exe
5032	Bootstrapper.exe
1112	msiexec.exe
1112	msiexec.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2968	WMIC.exe
Token: SeSecurityPrivilege	2968	WMIC.exe
Token: SeTakeOwnershipPrivilege	2968	WMIC.exe
Token: SeLoadDriverPrivilege	2968	WMIC.exe
Token: SeSystemProfilePrivilege	2968	WMIC.exe
Token: SeSystemtimePrivilege	2968	WMIC.exe
Token: SeProfSingleProcessPrivilege	2968	WMIC.exe
Token: SeIncBasePriorityPrivilege	2968	WMIC.exe
Token: SeCreatePagefilePrivilege	2968	WMIC.exe
Token: SeBackupPrivilege	2968	WMIC.exe
Token: SeRestorePrivilege	2968	WMIC.exe
Token: SeShutdownPrivilege	2968	WMIC.exe
Token: SeDebugPrivilege	2968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2968	WMIC.exe
Token: SeRemoteShutdownPrivilege	2968	WMIC.exe
Token: SeUndockPrivilege	2968	WMIC.exe
Token: SeManageVolumePrivilege	2968	WMIC.exe
Token: 33	2968	WMIC.exe
Token: 34	2968	WMIC.exe
Token: 35	2968	WMIC.exe
Token: 36	2968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2968	WMIC.exe
Token: SeSecurityPrivilege	2968	WMIC.exe
Token: SeTakeOwnershipPrivilege	2968	WMIC.exe
Token: SeLoadDriverPrivilege	2968	WMIC.exe
Token: SeSystemProfilePrivilege	2968	WMIC.exe
Token: SeSystemtimePrivilege	2968	WMIC.exe
Token: SeProfSingleProcessPrivilege	2968	WMIC.exe
Token: SeIncBasePriorityPrivilege	2968	WMIC.exe
Token: SeCreatePagefilePrivilege	2968	WMIC.exe
Token: SeBackupPrivilege	2968	WMIC.exe
Token: SeRestorePrivilege	2968	WMIC.exe
Token: SeShutdownPrivilege	2968	WMIC.exe
Token: SeDebugPrivilege	2968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2968	WMIC.exe
Token: SeRemoteShutdownPrivilege	2968	WMIC.exe
Token: SeUndockPrivilege	2968	WMIC.exe
Token: SeManageVolumePrivilege	2968	WMIC.exe
Token: 33	2968	WMIC.exe
Token: 34	2968	WMIC.exe
Token: 35	2968	WMIC.exe
Token: 36	2968	WMIC.exe
Token: SeDebugPrivilege	5032	Bootstrapper.exe
Token: SeShutdownPrivilege	4212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4212	msiexec.exe
Token: SeSecurityPrivilege	1112	msiexec.exe
Token: SeCreateTokenPrivilege	4212	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4212	msiexec.exe
Token: SeLockMemoryPrivilege	4212	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4212	msiexec.exe
Token: SeMachineAccountPrivilege	4212	msiexec.exe
Token: SeTcbPrivilege	4212	msiexec.exe
Token: SeSecurityPrivilege	4212	msiexec.exe
Token: SeTakeOwnershipPrivilege	4212	msiexec.exe
Token: SeLoadDriverPrivilege	4212	msiexec.exe
Token: SeSystemProfilePrivilege	4212	msiexec.exe
Token: SeSystemtimePrivilege	4212	msiexec.exe
Token: SeProfSingleProcessPrivilege	4212	msiexec.exe
Token: SeIncBasePriorityPrivilege	4212	msiexec.exe
Token: SeCreatePagefilePrivilege	4212	msiexec.exe
Token: SeCreatePermanentPrivilege	4212	msiexec.exe
Token: SeBackupPrivilege	4212	msiexec.exe
Token: SeRestorePrivilege	4212	msiexec.exe
Token: SeShutdownPrivilege	4212	msiexec.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
2812	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe
5228	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	firefox.exe
5228	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4568	5032	Bootstrapper.exe	83
PID 5032 wrote to memory of 4568	5032	Bootstrapper.exe	83
PID 4568 wrote to memory of 3164	4568	cmd.exe	85
PID 4568 wrote to memory of 3164	4568	cmd.exe	85
PID 5032 wrote to memory of 3752	5032	Bootstrapper.exe	91
PID 5032 wrote to memory of 3752	5032	Bootstrapper.exe	91
PID 3752 wrote to memory of 2968	3752	cmd.exe	93
PID 3752 wrote to memory of 2968	3752	cmd.exe	93
PID 5032 wrote to memory of 4212	5032	Bootstrapper.exe	96
PID 5032 wrote to memory of 4212	5032	Bootstrapper.exe	96
PID 1112 wrote to memory of 2528	1112	msiexec.exe	99
PID 1112 wrote to memory of 2528	1112	msiexec.exe	99
PID 1112 wrote to memory of 2032	1112	msiexec.exe	100
PID 1112 wrote to memory of 2032	1112	msiexec.exe	100
PID 1112 wrote to memory of 2032	1112	msiexec.exe	100
PID 1112 wrote to memory of 4420	1112	msiexec.exe	102
PID 1112 wrote to memory of 4420	1112	msiexec.exe	102
PID 1112 wrote to memory of 4420	1112	msiexec.exe	102
PID 4420 wrote to memory of 1668	4420	MsiExec.exe	103
PID 4420 wrote to memory of 1668	4420	MsiExec.exe	103
PID 4420 wrote to memory of 1668	4420	MsiExec.exe	103
PID 1668 wrote to memory of 3820	1668	wevtutil.exe	105
PID 1668 wrote to memory of 3820	1668	wevtutil.exe	105
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 1444 wrote to memory of 2812	1444	firefox.exe	122
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123
PID 2812 wrote to memory of 2148	2812	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3164
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding BA5BED3C86AAA9A0A3F84779B33AF1D9
  2⤵
  - Loads dropped DLL
  PID:2528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5D39E8D64AA9EA35AD3EFB6ECE47327C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DCEE320082F2D16DB148D6C78E3EF6D2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:3820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:1764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1972 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1828 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae035d71-2545-44c0-8ac0-8cf3bedee598} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" gpu
    3⤵
    PID:2148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {699742fd-8c08-45c3-a360-dbe6c0131641} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" socket
    3⤵
    - Checks processor information in registry
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2992 -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 2892 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c03875a-084b-4aa4-99fb-82f8c2541978} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" tab
    3⤵
    PID:4576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4032 -childID 2 -isForBrowser -prefsHandle 4012 -prefMapHandle 4008 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45a4f79b-5cfe-43ad-95b7-86c637479e8e} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" tab
    3⤵
    PID:5200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4840 -prefMapHandle 4836 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e0b5b0e-23d7-4cb2-9ad6-d1a903d66114} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" utility
    3⤵
    - Checks processor information in registry
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5364 -childID 3 -isForBrowser -prefsHandle 5280 -prefMapHandle 5264 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ce5afe2-ac48-4b1e-9e14-f5d1d5f76560} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" tab
    3⤵
    PID:5640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79a96565-8ec5-4257-bf6d-7301cd1175a1} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" tab
    3⤵
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5756 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7114f8e-01fb-41c3-b7c5-ca5b173da15c} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" tab
    3⤵
    PID:5664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6312 -childID 6 -isForBrowser -prefsHandle 6304 -prefMapHandle 6300 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1292 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55491b25-de16-4c7e-b770-ae69e081aec9} 2812 "\\.\pipe\gecko-crash-server-pipe.2812" tab
    3⤵
    PID:6108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6100
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5228
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 23738 -prefMapSize 244741 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99a0be28-9401-4603-be35-24ac09aef041} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" gpu
    3⤵
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20240401114208 -prefsHandle 2252 -prefMapHandle 2248 -prefsLen 23738 -prefMapSize 244741 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c559ef7d-be39-4448-8093-72a2163512bd} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" socket
    3⤵
    PID:1124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3324 -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3352 -prefsLen 24278 -prefMapSize 244741 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {024e7bda-01eb-4355-8702-9d521040f4d2} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab
    3⤵
    PID:1120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 2808 -prefsLen 29454 -prefMapSize 244741 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1a72e29-6bf4-4857-a057-5868ddb30ebb} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab
    3⤵
    PID:5156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4708 -prefMapHandle 4704 -prefsLen 29508 -prefMapSize 244741 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5db3d6e-0563-4d3e-b51f-0fe6e7af7c5b} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" utility
    3⤵
    - Checks processor information in registry
    PID:1432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5184 -childID 3 -isForBrowser -prefsHandle 5172 -prefMapHandle 5132 -prefsLen 27361 -prefMapSize 244741 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67e1c50e-92d0-4f01-80a5-5530e7114661} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab
    3⤵
    PID:5312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 4 -isForBrowser -prefsHandle 5408 -prefMapHandle 5404 -prefsLen 27361 -prefMapSize 244741 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc86c3d3-96f3-4c2f-bd35-b0f28a129275} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab
    3⤵
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5560 -childID 5 -isForBrowser -prefsHandle 5208 -prefMapHandle 5308 -prefsLen 27361 -prefMapSize 244741 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f22fd75-9443-4c97-b62f-36d7e02a0e75} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab
    3⤵
    PID:5340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57dce6.rbs

Filesize
1.0MB

MD5
4d1f7570bec28efb091919c8b2955b3c

SHA1
cb227eefc7c9ca533035e42721c806aa88f1e28e

SHA256
67f675986f873e15e67bed87d349e1848397f05b5341a011b77b5256bf739ade

SHA512
676f52025147bc56db4102bbbd2421e8ac531aefdf4ab528f90841b2fc8a2952b272a1342f3cf6ffd732c193ef9fc5d9fd58a3f86dbd15f8cbd78001782519f8

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url

Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
10869eb14cc38e9b766c4a99b6eb6618

SHA1
20e156d34c7055180fa3e6f576510069234ab051

SHA256
54649f69ad3f4a0c3e3c10309a5c82338bd7f520b7aad2c78d3e8c4e4d7f7bbb

SHA512
3b6688caf99a678f5b7b8b1f27800885b76118d0da66db01418d5933153cb7d964c7045c031d82a849d0b5131577a321f55910335588c5345ace893379b749be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
b332f12fbfefe56c8ee35e50fee1f2a0

SHA1
0b2ea8dad78765828ca428d00b684339f961f3b8

SHA256
077a6d231d2949f88fef22ce5e9f56f67f79cb18e5d0b51ebd78dbe78e4cc211

SHA512
7c6422e6271f2af5e0211552a62d4545eb81f59a3fe7a9e170621d88b8966c9eb8aea26cc038e6aeb86af91e4de4b0ad79643b7a363a1c4de9ac60973e666671

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
3cbfc56cc5a511a700f09c97744a3c17

SHA1
f0ef80736540c7e144f9501406144b94a233f4f4

SHA256
f9d9a480e94a671240f4a8c01ed36c3eb58dbc3c483cc09659dcedf01ab443b1

SHA512
19aaa787dda43fe7308f41c79639fe54df10259660da67641419b6b51becd6ed00cbfb9205c1cf9c7465feaa2d41cdd7eddf090eea2ddb6adab0869c13517187

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
386b9d2adf40198241062049aa5391bf

SHA1
a91dab1df0ebc636736c0483cb49209f3773fba6

SHA256
b3ce72a8e105ffa450fdd31ef01eb277ea591f57bcb524bead255d3c61f55f11

SHA512
ace997175899f867669e47569812dd4abe2cf714aa6786e42311fa6e2310bbf9ba6798366c6a8727ba4f5b21c0f509e8dee3fd8c8a4a1fcc0aa44e484ae252af

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

Filesize
132KB

MD5
01b475f5317f421257724e9fe5ee31f6

SHA1
18994ade63ac7fb4662008f6b1f68fc8fe6ffe13

SHA256
4e487c2668ecfa72be5de3a9086df9fedc671a5cec4ae90caff8e5cb5960c344

SHA512
556e2904c4e4db595326860b62ac7f921631ff1fffc73646e54093861d2242707523ab980fb364bb9ef9de9935ae724fdf2c2fda5342e5d4d5c155326f4d488e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
13KB

MD5
f99b4984bd93547ff4ab09d35b9ed6d5

SHA1
73bf4d313cb094bb6ead04460da9547106794007

SHA256
402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

SHA512
cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\startupCache\scriptCache-child.bin

Filesize
705KB

MD5
19bcb67b36d0284fb32873aad9382b44

SHA1
c2ce4e7798ff2373b2b576ded609847b5a472a70

SHA256
df3d383cba8360899ab4f9799f60b21d13514f32d5c5676a94fa985b501377ff

SHA512
0c19153c37e4fbeda74b0e32786a6fe99b2fab6c9691843a569f8613095e72b9d8c5a1128dcdfbc6c236dce4e5a514dce3c96ec17f22d4643120c7e00723fd1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\startupCache\scriptCache.bin

Filesize
8.6MB

MD5
42ef850edbc139a84e7e3b20653f072a

SHA1
8f4865cac36ba29890d1d0bbec93d36393d545c4

SHA256
4770d7a9a2fb83641bca7ba915eadd15fd6349d4a0fe3e37627550453feb08e5

SHA512
aceaca216366d624744005c55acc2c11c065bdf54c309358973d9cec1fca7f9cd9b12573c2be7487dba3e5147ef8b01ccf9237492bf8086deb3799eceab217f6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
5045b8bc06d1970e1e4d4143551e6f2c

SHA1
a52bb86d58527bda7c5a7a7e2c6e209867206910

SHA256
e98600cc534f85779cab54ef8b92ca1df4cf7a3953fb54b68d942e2ae42c343f

SHA512
39bc83fc6db853e4e3edccf00c5cc9dc0024c1266d88c995df00eb816a06aec3aa3f0b2784bfd1b692c2414312dc1727fc3042bd098abd91b0931c959ed08ed1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sd844ipy.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
7c9c5092fa93a0e4c1fa464d574a67a8

SHA1
b46159aab9851d191ec37b2bb4972795f069c08c

SHA256
711c217c051602bd97ce10209e122d0e0eb3e2da18ecd7132be13d7aba31231c

SHA512
c7227673a8590a4765a396ecc43ddfbd24ee65b78fe300c7daac9ad37d62be4288be2e6aabd29d1e63d017ff7c26727aadba5c82f8d11cded1269dd397d2e055

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\AlternateServices.bin

Filesize
7KB

MD5
c8d303ba90c07eec5845e34ed75a7993

SHA1
f1336e513939f15b65b1ab4520292c93562cb23b

SHA256
89d16e73f783fbbb41ffff27a2c57e5308b9576a4eb9d295d804fc80729226d9

SHA512
5ff91ff8956abf48810ddfc29f50fc47a2a3346b05758cf68f2915c89b78cbd6bb47b30017732339cb895fe5f07817ac3c3cb78ba4a219d2f28d049d09b46ed0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\AlternateServices.bin

Filesize
10KB

MD5
db7cffd97707a74dfdcb7b10347088fb

SHA1
0551af2d237e339bb0bd363b5be3a9e6de8117a5

SHA256
4efb725fc338ce0ced7292d192ad3c1fd23594e7f64b4484826bccfb9b3342d8

SHA512
c07bfd7f59485160b63c468b4e3ef3847dd28a0fc7f6c79bdfcd365f267bd7366653d395d0dcbfb75d567c5dc33bc5008edff0d5f473cb4dac6857c79bb90f53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\SiteSecurityServiceState.bin

Filesize
1KB

MD5
8bf83b10c6dbe60a32f426c197dcc3a5

SHA1
cfa425b20ea561e9094c64fdd3cbca266b6e0192

SHA256
a6de80bee23813f7237255b3364e292e2318c2d38c697e8ecb3e3d52a9ba3f1f

SHA512
0297f9c775c7af1ff6dc709f166e14f41bb97029fb6aa890209c145f2adea111acea68d0b63a289b4ed459d3ed4e8e098a0d0e1c5032f781ac2fe919a2cbef74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
064907e1ffc831708d3ec7feabf69b61

SHA1
06552d1319b655aece521958b398703e13f12334

SHA256
8f04459f927aee48370b019ab6bb900423730620a4a37d49131aadc43e798097

SHA512
dc934f47ac8606a39ddc73f749183ce43ccd6dc31f6761a0a6e8f05ca26919af58cc6706df35808d619a24f8347a790d1f2edcb604be2d54a19adb4c6054bed2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\cert9.db

Filesize
224KB

MD5
2c31bcfcd594e655349f32aea8af707c

SHA1
881a29523ba352a231e04a6130d4ac0b8aab773d

SHA256
f43182abe3d8646bf79d30d79ac7ec5bf8acaa5a760f405bef720366d4fa97a9

SHA512
6dd57139d841efcc524fcccd4695dc23085a38e9f8950a65e1b2dc2d373cd104a0d09277f8b56367cadad833be5f4cabd4b32b8f22a1576b11f627010eae2d56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\content-prefs.sqlite

Filesize
256KB

MD5
b41ed219e2c8dac47f2701562d092621

SHA1
90d507eae3ec943a121dbe5a080412e40470b54f

SHA256
cfed019635a1e14f74ae78f2c03fb96b40ac3da37b67489bd98c144afc200f1f

SHA512
5c6027ec701055efb3b6c055727af5ed261e8f1d5ba954e64e8a34e5c791679b1e4a6ef49896ab8089ec151fd758ba41efc7333611af42b851606a0544a9b947

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\cookies.sqlite

Filesize
512KB

MD5
8150c73e678434d4733303ef6bbc4230

SHA1
be55278a4aabbe56dc2efb316b255794df660935

SHA256
3974b82ef6d2db5b81996a1771e3ad61c8e62fd1ead7f59e83ef829a5f729832

SHA512
ff0e50fef3ed020bdd2eff849e43a7ff65f66b0d885ff23cb96feee215d55fbbba6fd54783106c4edf74c5e3f9dc9f2d1193195595916e383df1d37f0880257c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\db\data.safe.bin

Filesize
31KB

MD5
e341db1f3144ea4f5d783bc438294ce0

SHA1
051f6099756cf3802581bbd68c14f961308ba4ac

SHA256
cf10ab479dc5b05a69a8fe6d01676f00d6e11ed85ab4e3665f4f693941b14906

SHA512
be52afc375362bfc55a12158f58f9ef791895a6cea5250bc79302ad8b91bd7f02af8b7405b560d24b3fcf50fb494661b9afc5a9f94657f7593ffe03d7a1e3c14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
061e0b93839be996e199bd652763cdce

SHA1
39c947bda1e642d6161f370e05b8aa569175a111

SHA256
f847152fb01028be2dc482ef59d95969e5dda7b07ba2e286e083fff103161329

SHA512
1c87b21b4028c5913ea76183c6112982505f34a4b5114448308edf98f0a979b157aea33cb2c256c569402c91208d6d3c74f2caca4e3b0be442a9d2af5f899c12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
7a310e03476bb33e7add630d9f8b187c

SHA1
58891bf3abb4954558957164ea7adff427d84503

SHA256
9c4817013c5f1898e8b4a1722610398ee4a4bb6f3cb4d2f3c777abd3217e231e

SHA512
47e1fdb7c9a54f25b13d8f6b14b1ff0eee9ec376008622e7d0a634315bef91417808ae05c6ab84fe321035ca5ef64c7320cd528274c8b3ed844bc4000ee79468

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
31KB

MD5
9cf27f90dd1de619fdb1896c17228dda

SHA1
1c89329f6475e98c210c8fbb880466e414211fe0

SHA256
5f968b07846079d3cd55e1557fc76e49e25a8440f3d5f58cde52957648f39880

SHA512
abdbade3da130b452a4be186991f9a6ab2260a333fa55bff27223bf2fc2caf318604eb4c8452e7e3fda769ea8c56c44ef4b1ce663af84aa36dc37feba73744c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\db\data.safe.tmp

Filesize
30KB

MD5
4e577ed1d10913faba3e58fffcd4b426

SHA1
afb9c2921f35c29bf95b56e8a3396067721c5504

SHA256
67bf00e610d8e22f5beafadda503561a11fa966ecc383f06ff93436319fd4e14

SHA512
59699a903ade8d82deeba5eed072c81e7992666af3cd0759f594bfe4e0043ebbf8e9222a01882ce811484ddcaa3be18613231292e29629379d2d724c5a28cf46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\events\events

Filesize
934B

MD5
16d4279e01bc3b05c16e4aa59f5b6473

SHA1
94262ada0394114a0310006976634848fbad4b7f

SHA256
e8c55c7eaeb4d22e023f9924352e84ab9b497350f9d671778bc5d9005c3c210c

SHA512
a2240d6582ca14033e5b97fe71fb63eebe5e653830ac2fc13a707ecb2a4b3735a0344785f3ea9c1125c601f359b70e09deb0cf4f064a3ea9fde23c17587f76fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\events\pageload

Filesize
352B

MD5
093c7b69df83aab79e42100b2f253b6d

SHA1
96eefc1a31cd2cea0ff578d84d74f96059fe9ab4

SHA256
78be7e49f9168132ce0c35ad328d4aabfb379c3d0b069729a1675bfe5f36732c

SHA512
f2caab7e54a0766a0cc3ac9cd91e55f1602f1f6252f3e1c27837a9bb9bdc0d3c73997c36abfc165c50aeb902c9fa526f6f12a05077995ac0757318473068e908

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\pending_pings\15f18fbc-d0a0-4a2f-a0c1-bf1dbee244a2

Filesize
734B

MD5
3b2c2ea7536d47d00c4c36ac3facd06f

SHA1
9e4dcc9f74f04efec220a09450acbc5d6578a807

SHA256
3556467e15a34559089e418f62f783d00b40906799833eb0799bee5d29eb2df4

SHA512
1a2af78e8107d9a8d86ef55d9e0e6bb886afe16bd07a1950b58f502205c2dad5b1cd57763739379e2a82505c75bd8b4e83827ad319a6a43b0fb608d87f63ac89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\pending_pings\1c305482-452a-459a-ac68-25188b53e025

Filesize
741B

MD5
5148842e4a73533fd67c415c54fbfb69

SHA1
e655ff3eda8f42183748c3faf7c0842e8f472cd1

SHA256
1a3c23299f5651e18c3b5176f20aabf9cf593fe6ff89b3cf4b66184298752309

SHA512
9fd3ac2310e8105361461218d76509d08aeab9d17624ced97d37dd4c9791b607a44946cc1565a0cf0b5d855331984d509b0daa7dc9d6eaf4021ecc48f8f26d6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\pending_pings\3744aa4d-84b1-4433-a5f6-a2ecb167a0f3

Filesize
982B

MD5
752418d7304681f36da4de3d2e90d2f2

SHA1
213b618b95a292a2ef4c3cb563ba1a90cebcae9d

SHA256
a7743be1c7858989d9920eecec5f1134a9e406cf6d4bd5d6ab005a0d5030ee3e

SHA512
babd7171ed6a5acfa06a28d593a352a3bc32260c2c12bef1ecfb9d9c8e07afd80808babca24d50a1d5d08f6d5c631a791ae4cd18ce3aa01de4ed1d762e65caba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\pending_pings\5748e4a4-ce26-48b1-ae27-7028d84b2e8b

Filesize
671B

MD5
7845203298318236b0ab0eb8a860baad

SHA1
8ee1605c391bd0cef1bd14bc02ef24679f6446df

SHA256
aad276cdbacf0b093bcf257e62c2b8f43157e61d400b5318bc7af5c036a2bdfe

SHA512
25d61e89a0c01f4d90ebf72acba1e8422f209f2d9763e2901d41162729f69e8d657c97c9f5fbd3f57f70d3c557beb166c66b86d350ff7e3c937527b3be709902

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\pending_pings\7783b7bb-fca5-4c2a-8c4d-2a153b7c7ad3

Filesize
4KB

MD5
034a5e8308e8e14ae74a0b21baabea6c

SHA1
639389da94cd9de51651597efd4439c6ce4c1cf6

SHA256
ddfd5d15ee446a5cef2e40c9ab3adf095360f5722799e877e8e07c4a5263f334

SHA512
612233f33a1e33ab4f1b36400beb871095ae520cfb8cf8f0681595aa65d0fc0d8a02f6f6fe502b19ef7c78a82f18ee479d895deed958046c8fbd4ac16ef9eaaa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\pending_pings\9834b7f2-089d-4146-b941-b3e81cee8d27

Filesize
25KB

MD5
f910e28507e3fae38b2eb211c9f3b580

SHA1
f5768a3d14ec9dd2d9af0381f69f91b3505eadd6

SHA256
c15a993de715fa75ad0b682b08e4c334a87ffe53ff9ccc00cac78c04c4dff386

SHA512
7f979fc19e5c9d2fd16faadfc8026367ac3d717def0445e8610714437314b88ee94e04e1f969fdda1313ec26d7958f410303c31d65b7edccfe6752fe5a25371f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\datareporting\glean\pending_pings\d3cecda0-dd6b-499f-a97d-4c6bcdd9f889

Filesize
1KB

MD5
6d968012cea3c18c352b8c6522df75ed

SHA1
cc1e3631645d053a39ce829c09c0025a3302d06f

SHA256
9165b92493ab01fc6ceba0d53524ab3b128520b2d69d797de9a29650568d5eec

SHA512
3433ec989fe20332cc8f62be195c74f70a6f3264fd0746325f3a1afbeeb736411a325c524290c781d13f66cb78889da746ac2f10488067e50508a6649ce25428

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\favicons.sqlite

Filesize
5.0MB

MD5
a273e2778036f1a2fa75f2eedebb9509

SHA1
f0b47a0277a56d82458794d803ae7dfbc378fb6d

SHA256
c0e30429f0495563d352d8e7c043267f17ea82f3737f5f648bd175f1d4b10bfe

SHA512
ce9ae32c0e67ec7e4abc546c02ba0c7d7ada6e252c37d1f08d45a13828945234ae00b036ce2640f434898b0a4f34ae6ada832af21f2253b1a83f71246b9c76b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\permissions.sqlite

Filesize
96KB

MD5
92e519b67235602c957b18d924ee01e1

SHA1
a33009222651d9c70526eb0dadd08cc245d0908a

SHA256
ba7598c2f5fcb14d7b71a2be793ba53c6dcd6f5e27f5e6b1eadb9393f720ee15

SHA512
e30758a7456078d0e95900b05f2d9c2181b8f691e64cf1e9d831d9305db180f17b38a0b9c065737f8f4843a4b11b4ac7f2f84d8c7d079ba3f7263cdbfb5376c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\places.sqlite

Filesize
5.0MB

MD5
5272da15f715c9e756b2f6b7ac8976b0

SHA1
311711699fdc83c0b5e4295518cf04bc7698514f

SHA256
6e9d6b75e2c78a023a3032a48bbaa464b4e26d4b1c880a24f88c19473db69d05

SHA512
c769df0d8d2b360880dcee2436d11af49b2130b5754bbb8f6ba89ed6fdc988c9c03d010ae060b3416330e21c27197023076a0494d3270a49aaa6089aee835853

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\prefs-1.js

Filesize
10KB

MD5
9db510b420346016804d77a71c3692b2

SHA1
e2d866ed5e71b1a61d57aa2cc5c876d462080b0f

SHA256
e06fb49df20ad5dd3ffa66ffa6c674d6b9d9494c9cfd89cd1a30f0eadc4dff1f

SHA512
d2d17bc6d254ff202bc5da9d2f3ecc4168fd5387ef5b2e924ea1ca3183a0eef4f8fa115044a83a9f6a85e9f929f9c9e61ae2f4681d9c8cbbbf1a417be916e081

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\prefs-1.js

Filesize
11KB

MD5
7990d2d6d9c8806234667eb98b2e2f46

SHA1
87e31eef685cad73668f3d8cc08927fbb7f6668d

SHA256
511377e9775eace819738e3b8809f2f330731b8f12ef302020aecb3869e27dfe

SHA512
5dda9ae33502f0eaa5824ede54961b9b06fd6e5c8065918a1dd7bf0b3b4b64b91646c971ba56339115efba9f9d215ce13bc0a320fb5fb679e1c2f03ba9d98128

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\prefs-1.js

Filesize
10KB

MD5
c350a4c27e60978895da225298e8998c

SHA1
0b70aeabe53284adbbab1c92d4921cfbdf908861

SHA256
02531f050bd4b6c4ddb63a17dc0c37013f2f12f1a1927aef2038cb70f8599e2c

SHA512
900c876ef67d9db2fc937bd63823d4444565e963f851398e08edccffd21be6c57e761cce48bdc39dcd39b075a1e921525841e7a367b51f5d805ca678e632e0c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\prefs.js

Filesize
11KB

MD5
2719f1554eed4a4474e9372ca69cdc6d

SHA1
073416325a14aa6ba16e93e7e1cc722fd6194715

SHA256
66264bc5889506fa04d2634f92d7b5d301f1eafb92eace09f9fafee28130c5d5

SHA512
e74b8438604b82d7a088dfbaa0b409e0b4882a966356f2d40457cd30225b1e97abdb309f9ca321cb477427fef4d38a1b8987cb9f6e0d6a24ab45da0a79eb5a21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\protections.sqlite

Filesize
64KB

MD5
76786a4c0dd19d88d6d3ed95a293bf2f

SHA1
b0d6d676127a7694fc6e71ee57fcc2ffaa621ff7

SHA256
1a2564c1ba20b8038d35c2319258d94dc15d97914dcf753b31c48b79940dfd31

SHA512
8cd3298e2ebba763d3c80ac4b17e44af7eb63b46304967d0c6316d314baf8611c05f7b9979c2c5c329ac167aea0246e8c9f057ffbb272481c13fd5e4b4bcb2d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\sessionstore.jsonlz4

Filesize
4KB

MD5
23c95af276ac2f21761c6dedaa46fcdf

SHA1
8326775df71328891c674033700d9d3a3d109672

SHA256
0f382b55452670d12fe67e5eb0077e3de2826274ce4e4faf1db32910935a0983

SHA512
f230a4e06ac8b78d4cc63c19a8a9708234228accf9388a43fc4d6e3dce7019cc11b02ef874902a5ce909134f3cc17ddbbdbbf97cdfbc450feac5e35406c02e04

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\storage.sqlite

Filesize
4KB

MD5
0fb1ce8f5f7deed40021bcd34a14736a

SHA1
310e86d2924831972f1023c4f9965c1515e1ba1a

SHA256
4edd9aa5b4ebfe110a2cbc03dc2fdae3f2439247ea201fd59825c1cbd049ad65

SHA512
891c4c422d60dd90423801a4ff4aa5b181fbe2cd719442ac20633344eef6caab94b6adcabd1acc02cb162541c26e6905807beb2607fd7637d464b44228a99518

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
abb540955245a5c69c7fc022ae71799f

SHA1
1ac54207fe155428d9a414eb21d76133ed9c06d5

SHA256
4007e2156641796f5770c0abaeedf2f1c4e533754322e3b89fdca8f979e27dfd

SHA512
86c25eee35f0f8c3d0a30c75f95698e5fdd1af23dec49adf46a8ccdd94abe7249c1a22e1504a6e2bd0070ca7fe3594bdef40104b754a320c02465092fad6273b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
384KB

MD5
1af1a3e7fc2a32bf72d3dfb21cbacdca

SHA1
16c2b0e080c6c587f0cde01af5a05ce36aecc7b5

SHA256
20bf4cb3e956c37eaf34031042ffc404d70041e2fa0bffbda44eddc1c66e5609

SHA512
93c8d79eda4de1998dbec62189c7fb10bd7bca26525cfb230d8948542e29d494a1bf36580cb111e846594a05fd5bdd913226ec1ce0ff6f246b01fab811fdb577

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
568KB

MD5
ea28c9f2549a45717839e033dc7b13b6

SHA1
430303608ddba689ccb5b66a8b13d3f65c07103f

SHA256
00699683d17128f482fef7e0f86e59f9097bf75e40b3075b3be477d29ad5d79f

SHA512
bd1358cf02188acdfe4211601a2fc85cb9d795eaa6022c791bdb22d70af4da7cd3de64e4fddd4b0804c909bc230c2de887b2a19920fb4212aaacd696ec559a13

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sd844ipy.default-release\xulstore.json

Filesize
217B

MD5
3c7edbdeecdb47fba617e3d03c36b0d3

SHA1
53628ce8c5170810fabafab8e001bfd971d47825

SHA256
c3db6f2519b071b7441022f9ed508b0da5ba40295be0ee449a27bd6146595d04

SHA512
bbf56ea374114173f7de198cd71ac6e75276b0f30926c6690db512f45ac2e54d099d990c285578f702696494d2884d8550e5dddadeee01077933034ac3817842

Download Submit
C:\Windows\Installer\MSIE399.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSIE409.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIEA45.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
memory/1764-2420-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2429-0x000002831BD90000-0x000002831BD91000-memory.dmp

Filesize
4KB

Download
memory/1764-2427-0x000002831BD80000-0x000002831BD81000-memory.dmp

Filesize
4KB

Download
memory/1764-2450-0x000002831BED0000-0x000002831BED1000-memory.dmp

Filesize
4KB

Download
memory/1764-2449-0x000002831BED0000-0x000002831BED1000-memory.dmp

Filesize
4KB

Download
memory/1764-2447-0x000002831BEC0000-0x000002831BEC1000-memory.dmp

Filesize
4KB

Download
memory/1764-2415-0x000002831D140000-0x000002831D141000-memory.dmp

Filesize
4KB

Download
memory/1764-2451-0x000002831BFE0000-0x000002831BFE1000-memory.dmp

Filesize
4KB

Download
memory/1764-2435-0x000002831BCC0000-0x000002831BCC1000-memory.dmp

Filesize
4KB

Download
memory/1764-2432-0x000002831BD80000-0x000002831BD81000-memory.dmp

Filesize
4KB

Download
memory/1764-2426-0x000002831BD90000-0x000002831BD91000-memory.dmp

Filesize
4KB

Download
memory/1764-2418-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2399-0x0000028313B50000-0x0000028313B60000-memory.dmp

Filesize
64KB

Download
memory/1764-2416-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2422-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2424-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2417-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2423-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2425-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2421-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/1764-2383-0x0000028313A50000-0x0000028313A60000-memory.dmp

Filesize
64KB

Download
memory/1764-2419-0x000002831D170000-0x000002831D171000-memory.dmp

Filesize
4KB

Download
memory/5032-5-0x00007FF8F3550000-0x00007FF8F4012000-memory.dmp

Filesize
10.8MB

Download
memory/5032-2-0x00007FF8F3550000-0x00007FF8F4012000-memory.dmp

Filesize
10.8MB

Download
memory/5032-1-0x00007FF8F3553000-0x00007FF8F3555000-memory.dmp

Filesize
8KB

Download
memory/5032-4-0x0000021D8D4D0000-0x0000021D8D4F2000-memory.dmp

Filesize
136KB

Download
memory/5032-2382-0x0000021D8D550000-0x0000021D8D55A000-memory.dmp

Filesize
40KB

Download
memory/5032-0-0x0000021D8B770000-0x0000021D8B83E000-memory.dmp

Filesize
824KB

Download