phantomstealer | 4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
31/10/2025, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSVCP140.dll
Size 5.7MB
Sample251031-erblwsfv2a
SHA256 363022bd7bf8deb61785a3ec95d107893370f329ae2460effc5a1addd100995d
MD5 64837a9c4b7165f305ea9b6d1554a68e
SHA1 2cb5e9901bc76ecbd303c765e035f228e3e0b291
SHA512 f92bd14c9798c27138f9a07eceb8099101d209dd5e281cbdf7b45809cb8d324c1f0206195950cebee86c4542c545a29bb4f0418670fdf10abc1fb0a6f763086c
SSDEEP 49152:BlClpF9AqFx3mqO0+rjJEipVb/sC6aF/Sad0H7/UAeVCux70BEsHIMY3LkYP2GuS:rqOrpV7Fld0bSaKMkP8BR3WKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantomstealer persistence

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z
Email to
[email protected]

Mutex

12YHANZ1JWN7VAAFXR6S

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Windows\CurrentVersion\Run\DefaultDomain = "cmd.exe /C pushd \"C:\\Windows\\system32\\Container\" && start \"\" \"C:\\Windows\\system32\\Container\\DefaultDomain\""	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\Container\CallButtons.ProxyStub.dll	rundll32.exe
File created	C:\Windows\system32\Container\DisplaySystemToastIcon.png	rundll32.exe
File created	C:\Windows\system32\Container\PortableDeviceConnectApi.dll	rundll32.exe
File created	C:\Windows\system32\Container\schtasks.exe	rundll32.exe
File created	C:\Windows\system32\Container\WLanConn.dll	rundll32.exe
File created	C:\Windows\system32\Container\KBDSYR2.DLL	rundll32.exe
File created	C:\Windows\system32\Container\tcpmib.dll	rundll32.exe
File created	C:\Windows\system32\Container\VpnSohDesktop.dll	rundll32.exe
File created	C:\Windows\system32\Container\WUDFCoinstaller.dll	rundll32.exe
File created	C:\Windows\system32\Container\TpmTool.exe	rundll32.exe
File created	C:\Windows\system32\Container\SettingsHandlers_Troubleshoot.dll	rundll32.exe
File created	C:\Windows\system32\Container\bthserv.dll	rundll32.exe
File created	C:\Windows\system32\Container\iscsicpl.exe	rundll32.exe
File created	C:\Windows\system32\Container\manage-bde.wsf	rundll32.exe
File created	C:\Windows\system32\Container\MSDvbNP.ax	rundll32.exe
File created	C:\Windows\system32\Container\netbtugc.exe	rundll32.exe
File created	C:\Windows\system32\Container\Windows.Graphics.Printing.Workflow.dll	rundll32.exe
File created	C:\Windows\system32\Container\termmgr.dll	rundll32.exe
File created	C:\Windows\system32\Container\bdeunlock.exe	rundll32.exe
File created	C:\Windows\system32\Container\CloudIdWxhExtension.dll	rundll32.exe
File created	C:\Windows\system32\Container\KernelBase.dll	rundll32.exe
File created	C:\Windows\system32\Container\FXSUTILITY.dll	rundll32.exe
File created	C:\Windows\system32\Container\modernexecserver.dll	rundll32.exe
File created	C:\Windows\system32\Container\wermgr.exe	rundll32.exe
File created	C:\Windows\system32\Container\tapiperf.dll	rundll32.exe
File created	C:\Windows\system32\Container\edputil.dll	rundll32.exe
File created	C:\Windows\system32\Container\netapi32.dll	rundll32.exe
File created	C:\Windows\system32\Container\ApproveChildRequest.exe	rundll32.exe
File created	C:\Windows\system32\Container\mimofcodec.dll	rundll32.exe
File created	C:\Windows\system32\Container\typeperf.exe	rundll32.exe
File created	C:\Windows\system32\Container\winnlsres.dll	rundll32.exe
File created	C:\Windows\system32\Container\MinstoreEvents.dll	rundll32.exe
File created	C:\Windows\system32\Container\vaultsvc.dll	rundll32.exe
File created	C:\Windows\system32\Container\WiaExtensionHost64.dll	rundll32.exe
File created	C:\Windows\system32\Container\KBDLT1.DLL	rundll32.exe
File created	C:\Windows\system32\Container\SebBackgroundManagerPolicy.dll	rundll32.exe
File created	C:\Windows\system32\Container\SettingsHandlers_AssignedAccess.dll	rundll32.exe
File created	C:\Windows\system32\Container\VPNv2CSP.dll	rundll32.exe
File created	C:\Windows\system32\Container\dwmscene.dll	rundll32.exe
File created	C:\Windows\system32\Container\fhevents.dll	rundll32.exe
File created	C:\Windows\system32\Container\pwlauncher.dll	rundll32.exe
File created	C:\Windows\system32\Container\taskkill.exe	rundll32.exe
File created	C:\Windows\system32\Container\atl100.dll	rundll32.exe
File created	C:\Windows\system32\Container\C_1142.NLS	rundll32.exe
File created	C:\Windows\system32\Container\fltLib.dll	rundll32.exe
File created	C:\Windows\system32\Container\riched20.dll	rundll32.exe
File created	C:\Windows\system32\Container\UserDataAccountApis.dll	rundll32.exe
File created	C:\Windows\system32\Container\DispBroker.dll	rundll32.exe
File created	C:\Windows\system32\Container\IppCommon.dll	rundll32.exe
File created	C:\Windows\system32\Container\KBDSORST.DLL	rundll32.exe
File created	C:\Windows\system32\Container\MessagingDataModel2.dll	rundll32.exe
File created	C:\Windows\system32\Container\Microsoft.Graphics.Display.DisplayEnhancementService.dll	rundll32.exe
File created	C:\Windows\system32\Container\SearchIndexer.exe	rundll32.exe
File created	C:\Windows\system32\Container\UIManagerBrokerps.dll	rundll32.exe
File created	C:\Windows\system32\Container\w32topl.dll	rundll32.exe
File created	C:\Windows\system32\Container\DevPropMgr.dll	rundll32.exe
File created	C:\Windows\system32\Container\DispBroker.Desktop.dll	rundll32.exe
File created	C:\Windows\system32\Container\GameSystemToastIcon.contrast-white.png	rundll32.exe
File created	C:\Windows\system32\Container\KBDINBEN.DLL	rundll32.exe
File created	C:\Windows\system32\Container\Microsoft.Uev.SyncCommon.dll	rundll32.exe
File created	C:\Windows\system32\Container\perfc009.dat	rundll32.exe
File created	C:\Windows\system32\Container\tcbloader.dll	rundll32.exe
File created	C:\Windows\system32\Container\Windows.UI.Cred.dll	rundll32.exe
File created	C:\Windows\system32\Container\glu32.dll	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 776 set thread context of 2364	776	rundll32.exe	78

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1811515719-224358676-1950738906-1000\{B21BF5E2-0B2D-4A0F-94B7-CD5C6870568F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2364	AddInProcess32.exe
2364	AddInProcess32.exe
1456	chrome.exe
1456	chrome.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
3864	firefox.exe
3864	firefox.exe
2364	AddInProcess32.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2364	AddInProcess32.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	AddInProcess32.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	1456	chrome.exe
Token: SeCreatePagefilePrivilege	1456	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe
Token: SeShutdownPrivilege	5448	chrome.exe
Token: SeCreatePagefilePrivilege	5448	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1456	chrome.exe
1456	chrome.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
3864	firefox.exe
5992	msedge.exe
968	msedge.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
5448	chrome.exe
5448	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3864	firefox.exe
2420	firefox.exe
2364	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2364	776	rundll32.exe	78
PID 776 wrote to memory of 2364	776	rundll32.exe	78
PID 776 wrote to memory of 2364	776	rundll32.exe	78
PID 776 wrote to memory of 2364	776	rundll32.exe	78
PID 776 wrote to memory of 2364	776	rundll32.exe	78
PID 776 wrote to memory of 2364	776	rundll32.exe	78
PID 2364 wrote to memory of 1456	2364	AddInProcess32.exe	80
PID 2364 wrote to memory of 1456	2364	AddInProcess32.exe	80
PID 1456 wrote to memory of 2464	1456	chrome.exe	81
PID 1456 wrote to memory of 2464	1456	chrome.exe	81
PID 1456 wrote to memory of 5812	1456	chrome.exe	82
PID 1456 wrote to memory of 5812	1456	chrome.exe	82
PID 2364 wrote to memory of 2464	2364	AddInProcess32.exe	81
PID 1456 wrote to memory of 5636	1456	chrome.exe	83
PID 1456 wrote to memory of 5636	1456	chrome.exe	83
PID 1456 wrote to memory of 3852	1456	chrome.exe	84
PID 1456 wrote to memory of 3852	1456	chrome.exe	84
PID 2364 wrote to memory of 2464	2364	AddInProcess32.exe	81
PID 1456 wrote to memory of 244	1456	chrome.exe	85
PID 1456 wrote to memory of 244	1456	chrome.exe	85
PID 1456 wrote to memory of 4708	1456	chrome.exe	86
PID 1456 wrote to memory of 4708	1456	chrome.exe	86
PID 1456 wrote to memory of 3192	1456	chrome.exe	87
PID 1456 wrote to memory of 3192	1456	chrome.exe	87
PID 1456 wrote to memory of 5160	1456	chrome.exe	88
PID 1456 wrote to memory of 5160	1456	chrome.exe	88
PID 1456 wrote to memory of 5036	1456	chrome.exe	89
PID 1456 wrote to memory of 5036	1456	chrome.exe	89
PID 1456 wrote to memory of 1940	1456	chrome.exe	90
PID 1456 wrote to memory of 1940	1456	chrome.exe	90
PID 2364 wrote to memory of 1456	2364	AddInProcess32.exe	80
PID 2364 wrote to memory of 1456	2364	AddInProcess32.exe	80
PID 1456 wrote to memory of 1916	1456	chrome.exe	91
PID 1456 wrote to memory of 1916	1456	chrome.exe	91
PID 2364 wrote to memory of 4708	2364	AddInProcess32.exe	86
PID 2364 wrote to memory of 4708	2364	AddInProcess32.exe	86
PID 2364 wrote to memory of 5636	2364	AddInProcess32.exe	83
PID 2364 wrote to memory of 5636	2364	AddInProcess32.exe	83
PID 1456 wrote to memory of 2176	1456	chrome.exe	92
PID 1456 wrote to memory of 2176	1456	chrome.exe	92
PID 1456 wrote to memory of 5980	1456	chrome.exe	93
PID 1456 wrote to memory of 5980	1456	chrome.exe	93
PID 1456 wrote to memory of 5948	1456	chrome.exe	94
PID 1456 wrote to memory of 5948	1456	chrome.exe	94
PID 2364 wrote to memory of 1916	2364	AddInProcess32.exe	91
PID 2364 wrote to memory of 2464	2364	AddInProcess32.exe	81
PID 2364 wrote to memory of 2464	2364	AddInProcess32.exe	81
PID 2364 wrote to memory of 5036	2364	AddInProcess32.exe	89
PID 2364 wrote to memory of 5036	2364	AddInProcess32.exe	89
PID 2364 wrote to memory of 1940	2364	AddInProcess32.exe	90
PID 2364 wrote to memory of 1940	2364	AddInProcess32.exe	90
PID 2364 wrote to memory of 5812	2364	AddInProcess32.exe	82
PID 2364 wrote to memory of 5812	2364	AddInProcess32.exe	82
PID 2364 wrote to memory of 3852	2364	AddInProcess32.exe	84
PID 2364 wrote to memory of 3852	2364	AddInProcess32.exe	84
PID 2364 wrote to memory of 1456	2364	AddInProcess32.exe	80
PID 2364 wrote to memory of 1456	2364	AddInProcess32.exe	80
PID 2364 wrote to memory of 5160	2364	AddInProcess32.exe	88
PID 2364 wrote to memory of 5160	2364	AddInProcess32.exe	88
PID 2364 wrote to memory of 4708	2364	AddInProcess32.exe	86
PID 2364 wrote to memory of 4708	2364	AddInProcess32.exe	86
PID 2364 wrote to memory of 5636	2364	AddInProcess32.exe	83
PID 2364 wrote to memory of 5636	2364	AddInProcess32.exe	83
PID 2364 wrote to memory of 1916	2364	AddInProcess32.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll,#1
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff87684dcf8,0x7ff87684dd04,0x7ff87684dd10
      4⤵
      PID:2464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1908,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      PID:5812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --field-trial-handle=1948,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
      4⤵
      PID:5636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --field-trial-handle=2152,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
      4⤵
      PID:3852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2816,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:1
      4⤵
      PID:244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2824,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3256,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3264,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:9
      4⤵
      PID:5160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2784,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:5036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3340,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:9
      4⤵
      PID:1940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4144,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:1916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --field-trial-handle=4408,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --field-trial-handle=4424,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3" --field-trial-handle=4472,i,685636403226821302,4273741045078657420,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4uak0dj.hxu"
    3⤵
    PID:2440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\a4uak0dj.hxu
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3864
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {f1915aa6-c6a4-4094-ad79-f152881867be} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6016
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2316 -prefsLen 27133 -prefMapHandle 2324 -prefMapSize 270279 -ipcHandle 2348 -initialChannelId {fbb5a0e9-c818-4311-9683-8e373cef2bf8} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4172
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c4e0d83-4a15-4112-bd3d-4ffc4b8661ca.dmp"
        5⤵
        
        PID:1316
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2220 -prefsLen 27133 -prefMapHandle 2852 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {02106cf8-bf7b-4518-ab55-7ab1d51fbdfc} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1928
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55bbb0b7-e4ca-44fe-a89f-17723b68a629.dmp"
        5⤵
        
        PID:5724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2872 -prefsLen 27133 -prefMapHandle 3032 -prefMapSize 270279 -ipcHandle 3020 -initialChannelId {b38c357c-badf-4e89-9bda-7a4e39ddc442} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5164
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\46e1f516-f9b0-42f0-bb24-d997b694f8a4.dmp"
        5⤵
        
        PID:3068
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3116 -prefsLen 27247 -prefMapHandle 3312 -prefMapSize 270279 -ipcHandle 3340 -initialChannelId {7656f156-7ee7-48ea-8ad8-daf9837966ca} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3700 -prefsLen 27323 -prefMapHandle 3704 -prefMapSize 270279 -jsInitHandle 3708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3716 -initialChannelId {96722011-bd4d-4136-b2d6-7a19830e2cd8} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4476
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7ea2a722-a299-4581-95d8-5dfbff950676.dmp"
        5⤵
        
        PID:5096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3340 -prefsLen 27323 -prefMapHandle 3672 -prefMapSize 270279 -ipcHandle 3664 -initialChannelId {c086c82e-56f3-4ffa-80c2-4ba5925ea028} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:6064
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\22e4ca41-6c17-43d4-b9a8-25d23a55bacf.dmp"
        5⤵
        
        PID:3984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4392 -prefsLen 27323 -prefMapHandle 4396 -prefMapSize 270279 -ipcHandle 3708 -initialChannelId {80eff592-4c56-4b6f-94ba-88ebcb7eab03} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3612 -prefsLen 34822 -prefMapHandle 3616 -prefMapSize 270279 -jsInitHandle 2612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4708 -initialChannelId {35ee292b-0fdd-4570-a06a-2f723e8cfc1c} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:3044
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5136 -prefsLen 34929 -prefMapHandle 5140 -prefMapSize 270279 -ipcHandle 5184 -initialChannelId {221e6eb9-79a4-40e3-85c6-4cf283e04686} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:3008
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2520 -prefsLen 32952 -prefMapHandle 2524 -prefMapSize 270279 -jsInitHandle 3512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3028 -initialChannelId {c301c9ff-4e09-4018-82f6-343dd3517d8a} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2584
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3156 -prefsLen 32952 -prefMapHandle 5080 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4844 -initialChannelId {3d26946b-6d85-42f2-808a-58220ff4c1f1} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:1712
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 32952 -prefMapHandle 5736 -prefMapSize 270279 -jsInitHandle 5740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {71f339d5-2b50-4464-8fc6-7a63de595590} -parentPid 3864 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3864" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ff86525f208,0x7ff86525f214,0x7ff86525f220
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2344,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=2008,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=2464,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3272,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3284,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=3476,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=3480,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=3488,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3600,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3640,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:9
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3668,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3728,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:9
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3768,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3812,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:9
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3848,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3856,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:9
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3908,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3920,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:9
      4⤵
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=4644,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
      4⤵
      PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=5192,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:14
      4⤵
      PID:4872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=5300,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=5352,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=5480,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=5520,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=6168,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg" --always-read-main-dll --field-trial-handle=6168,i,15021581582236535929,4265618150867229654,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff86525f208,0x7ff86525f214,0x7ff86525f220
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2324,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=2112,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=2460,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3328,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3336,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=3748,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=3756,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=3764,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3852,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3872,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3888,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3964,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3972,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4000,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:9
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4012,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4028,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4068,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4076,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:9
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=3312,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=5292,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
      4⤵
      PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=568
        5⤵
        
        PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=5308,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=5388,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=5096,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl" --always-read-main-dll --field-trial-handle=5268,i,4981372599363202031,18317165977676961286,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:5764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ulhccany.m0y"
    3⤵
    PID:3328
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ulhccany.m0y
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270331 -ipcHandle 2020 -initialChannelId {7aa114c6-9301-432b-8f94-991494e954af} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5188
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27133 -prefMapHandle 2484 -prefMapSize 270331 -ipcHandle 1912 -initialChannelId {ca8b3aaa-a929-47f9-aab6-6e14b4921d79} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4584
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\484a052a-19cd-4f2d-975f-b5997c4b6b76.dmp"
        5⤵
        
        PID:4804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2184 -prefsLen 27133 -prefMapHandle 1412 -prefMapSize 270331 -ipcHandle 2828 -initialChannelId {cf6c5cb6-a08c-43a1-8dae-80649f23037c} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5672
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a7aceb6c-aeb4-49b4-b7c4-5e9f97edeb18.dmp"
        5⤵
        
        PID:2840
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2828 -prefsLen 27182 -prefMapHandle 2884 -prefMapSize 270331 -ipcHandle 3088 -initialChannelId {dd94afb4-7433-4101-9dee-809f8c1ea0c8} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4996
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 27323 -prefMapHandle 3768 -prefMapSize 270331 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {7aca8258-c250-4f34-9cf6-d5e790b43d1a} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:2092
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0dec199d-1963-441b-89da-f290ebe67916.dmp"
        5⤵
        
        PID:1460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3304 -prefsLen 27323 -prefMapHandle 3924 -prefMapSize 270331 -ipcHandle 3668 -initialChannelId {c35e123e-058c-474c-81e8-91cad2a926c0} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5064
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\56ad880b-dc2a-414a-a577-89c2a9791479.dmp"
        5⤵
        
        PID:1420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4104 -prefsLen 27323 -prefMapHandle 4100 -prefMapSize 270331 -ipcHandle 3908 -initialChannelId {b0b1f54e-c7c8-41e0-9b95-d06b048b8d63} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:732
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3184 -prefsLen 34876 -prefMapHandle 4388 -prefMapSize 270331 -jsInitHandle 3196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3244 -initialChannelId {6936bdab-7ca2-4384-84be-83c184232876} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:4648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 34876 -prefMapHandle 4984 -prefMapSize 270331 -ipcHandle 4992 -initialChannelId {69b3b2dc-dd68-42ed-8f5f-8634af7158f4} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:2060
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32766 -prefMapHandle 5140 -prefMapSize 270331 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {2c259daa-f26f-4c7c-8965-d8085c3a105f} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:3052
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 32766 -prefMapHandle 5176 -prefMapSize 270331 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {440673a5-7f1d-499a-b219-78f3a4ca3f76} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1304 -prefsLen 32818 -prefMapHandle 4976 -prefMapSize 270331 -jsInitHandle 5592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5600 -initialChannelId {bf4ecd79-b9fe-448b-9a53-02ac9c8ff3da} -parentPid 2420 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2420" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff87171dcf8,0x7ff87171dd04,0x7ff87171dd10
      4⤵
      PID:2544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2560,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
      4⤵
      PID:1224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --field-trial-handle=1744,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
      4⤵
      PID:5240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --field-trial-handle=2004,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
      4⤵
      PID:3688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3468,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
      4⤵
      PID:5472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3484,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:9
      4⤵
      PID:1184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3504,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3520,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:9
      4⤵
      PID:700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4352,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:4844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --field-trial-handle=4380,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
      4⤵
      PID:684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --field-trial-handle=4092,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\53ju4lw2.tvj" --field-trial-handle=4484,i,533800681060302180,17813186633971917500,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
1⤵
PID:3984

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5096

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\activity-stream.contile.json
Size 5KB
SHA256 f9b6946ef0afa5ed4f42adb96c82f93e7a2308fe575d10400fde546c86eb12b7
MD5 26ca9b26bf5f526ef4b37a3ecf48a5bf
SHA1 3c4aa8643d570448dc38e1cb38732c582dff17b0
SHA512 2322c97d0561ea71fa780b0bdb0edf48cd9595acdd61f365158808de5ef80104051768f15a3095c94e89ff5a3c18124f02e34a2a7f8ea2a4d651a0c031629391
SSDEEP 96:Ke+w9tvrXQ8BnVcAd80oz+ZnjcmCsezEol:Ke+ctvrQ8Bnnd80uanjcmYz7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 8de773332bf4e7a84c91d70193600abeab0aa3a9ea383f0e0f17e432bc12a6c0
MD5 f4a711151473a4347b3de953f7e06721
SHA1 37bf87517e4b5595e824b257be5b28ecddc7b01e
SHA512 da9d62e4ecbad838852786e314793d08e5ac4762a930947c172b5a9cdd832192340118915d884a19b30903724111e2cf0b3f6a000b1755a3548306cfaa9f5c1c
SSDEEP 384:7yaKFu88Hdnf5bLlR7YCvIyRg4fsiixph4t+R9TORRIdAK:7yfI881RDY9liqDOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 14KB
SHA256 2a52aa67744ed149f95706b57d7b5c35c195d6c76dd2f0e6f1f6961540c83a25
MD5 c203d3a2524805d7b41bb05f6153ceff
SHA1 18b7db81dbc00476da54559d1bf17ecec751c132
SHA512 8232aa2a254d2c9e6b69beb41c8dfbcc92936ca0c3c0e5c644c229fb779205cb6fefc1f4fae4c86981d277e0cf1c0c785769396b9dd5b2f778519050bd68783c
SSDEEP 384:HV9BpiO024Yj7hSznZOML+CbcxDEclrIVy8eboQozn:1EZYj7hSz8MLPbcxDEcVIVy89
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 d7d3431201520b7612da9fa25a54f730f915ca5c7657ed8a5719a27670f1c626
MD5 5dc85b85c9db58c33ae18dc2150eb21b
SHA1 3332645ce6c095732daf8bf9f4ebd349367895bf
SHA512 c3d1f53e4c434a2ad16a2d5bfc5a354458c7e45dd3e5a12e4ef77b1da234b0dc0660ab75eb2bd70dc2a6e7d41c9fba10bda9cf51a11d08a3b12b96ebbaba96f4
SSDEEP 1536:jTrliXE/DDJFi4J4OCVcM00JIWuTEVKPXBn7a53K0oLkpsZw3OFhZ9UyXEjQv7sQ:j3lpi4JgYRPTEUROpNOx9U70sqdJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Crashpad\settings.dat
Size 280B
SHA256 76cefcf3a75efcaf2013e50f118d4c72ba7e642c4f2b9143129c601b02325e36
MD5 dbcd592602d32ad3fcc0582fed999b7e
SHA1 0120543b31063259397493a4a552916090beb5a4
SHA512 fe38a93e0d120a01d564f2d00877b132162705982efe348a6e649b1748900a6167edaf4bc08815c34c81c3e579de530dad4ba3aedf18f44f3f0c63aa9c2f6a14
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Crashpad\settings.dat
Size 280B
SHA256 3b4b52721b099510a0afd831418082e779988440b52020896c09f23e470a2b0d
MD5 9ecbae0c1f9654c3cb83a9238f99cca2
SHA1 8315abc62bdf02821f001e5d672a03fad6ea4232
SHA512 7d2f998af81a2316a6e99bcb14f0014cd5155e71603e1f952ded71f401b5931bcc7520d158bfe9c5834ea047459f927e419977107465349dd6c475ef12af2c4f
MD5 SHA1 SHA512

Submit Download

5f7977e5-e713-438d-8c7e-c4d2f6aa9da6.tmp

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\5f7977e5-e713-438d-8c7e-c4d2f6aa9da6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000003
Size 63KB
SHA256 a9c9c90931e351cba32704d61f1d329d7a9df76145a8d0dc71e194f293abf425
MD5 ceddc0ede5679a07157e742c028d8cc1
SHA1 48af4601ef9feaf67aa08de7e7e6d7f646db4041
SHA512 8c81f96035fe679bd86a4cc490d10e2754817be3fd08fe2a11a0a4bea82e3d102ed4d2a69e20ec347314658b51f931b17e9f3a1ea82c4e28256cc4165431ff66
SSDEEP 1536:RRLKoT08wUGIDL9uWiYp8araK2xQbypF449xYPMk2xmct/p5CWbL:RRLzT0E56c82RlypFT9WPMkYmctxsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000005
Size 383KB
SHA256 dc3af441eb066cbda7e42f12fb2b4a3df6f7d56b64b94ad8d099de55e4738c46
MD5 294155765131d445bb3d8e94bebe8d75
SHA1 b6e1cddb101abbddba067e18c9830f8215acb459
SHA512 f86e15e69866fbb47971334f45e19fd4c1ed72ddaff109696cc190fbeaed60904731be665cb98371bf8e291e9ddf7f9772ed24ffdddd21e3564d624c7d2b1bb7
SSDEEP 6144:D9KxWHBWzAY0a9Fufaaqy1h6wVY41jhnSJ5x8T398XPQUI0YLg8FHe8y8KwrTZkd:D4xWhhbE091h6FoSnx8T98YmYBFHIbwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_00000a
Size 72KB
SHA256 d532c0033bd892149ba6d22122425ce16e0b9916be3b96edb5d1215892741705
MD5 e8397f14ee34e3d2661d6a762db8ce28
SHA1 c897cf196851f971ac0a728866c1bd1eba41590c
SHA512 b2a8530593aedc867af7daab3fbe40c2649549f977120bdbd073839efe8b5546c5eee83d5788262d0373c5674d90505d02046758b5f6ad0819e5dac71b2ba65b
SSDEEP 1536:Xllt4fEDp707LH1E9kb+zw4oGp6LHXDjMrupuAHnVY3jUUX1AqaPdJp3MdF3TsBf:1PdpcLVE9kcw4oGp6zXCun1Y4UXiJide
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_00000b
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_00000c
Size 16KB
SHA256 283e231a1dedf20c3f98eb1452ec52d042179d31a6ee482e54b51066074faf42
MD5 46b49aad1412c12943384f8afb51204f
SHA1 e6a38f254f0681007745ededdde176ec64670723
SHA512 8b521405691a78c9f03740f2484f6f07ae881cb1ea5d18336fa44771ec025d1dab438c1a849c30a3b7fbabd9dc391fe4aff499a09de1af6391611d1752ee8d45
SSDEEP 384:iEEbbexRg+TpS0d0qXYsoXB+SBuqkXL214/R7MI7fm:WexRbw0/XYf+SBQ/xMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_00000d
Size 17KB
SHA256 5e41837a6aba4a285df072ad0290e7f9e1dc4682799f71e33222a3a0d6e5a082
MD5 9e6475d889c8916a680317ec48b212c1
SHA1 daea8c5b6cf03d05fb8ee7fcc18320eefd2ee0ca
SHA512 7c4f34e50b5bf4bc95d59a2ae648a673e4a7dbb9669f73d6512dd12521335297886168c5c00f60cca5f85a655265c49355c3ad113e62124577f75f45abaf534c
SSDEEP 384:DlDTvwo0JYeOCqDG+G8fPv4yDs3HsxaYprRr2y0BYi1n:BXwoy9OCHifts3HsYKroBpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_00000f
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000010
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000017
Size 18KB
SHA256 cb78510332b46564f4369bf31ff85c1ab0016bbcef3110b9b9388b88f1cf4795
MD5 9e32121253edde20161adf93523eb060
SHA1 4b9267459ba3c68bd08e6492a270ccaefe2c2dbf
SHA512 7b5c22ac424e32122637c434f4a087b87ba43ac341c008a4df3d0f57f443e38c68f75ae6087e16cf3d7c651a8a35b80faaa8a28b866b1c0def48e3b6c451fae8
SSDEEP 384:USS65/+IiYmwVYkgDdUlzU7SjcKalWW4sIkb6d2e/Oc+C2kZu:lS64ZimDWz/jcK3WRIkMnmo2Su
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000022
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_00002f
Size 33KB
SHA256 89ab09e7b2d516d5292607553dec92832148ab1a3c37529b7ae4a108477cc387
MD5 baebf31c834043f30f329f8105626445
SHA1 743c63a89cb813094b68af4b8bd2886624c1a08e
SHA512 c98727173145a6b93cb3c1790d9067503966ff617ca50201c68e60051269223cf728b65b439456bf197921324c3f133c057690e8ceaf3f899561def9dc41cf74
SSDEEP 768:AdkIw38+GJp0WyTh17LiGi3m6W2MNc+0lgntGsWEOn:AdzoApU2Gu7INc+0l0t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_000039
Size 17KB
SHA256 1c252d3f3dc6616ebbfc5cd29e8537f2abdbfa6b34a624c9a20038ffe1c3cf53
MD5 0408f0b32584dacda0d3bc0a5233d8db
SHA1 798be1217f22d352ebaef5402d4245cea48ab48a
SHA512 9e344569a968561d6c9cf7ccf8caccf9140cb995a69c7bfe9f23a939393d13633749a13417f6e73347a62e65107df03bb63c0cead6c7574f153f707c94e603ba
SSDEEP 384:11lSwURGstPKEYa5FnpxYdxoAscuJjEK/M0AK4:8HRGst3DPpxYdxotJjEJ0AK4
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Cache\Cache_Data\f_00003b
Size 37KB
SHA256 6df0197d5710db66a7ef315a0576051377f58955d73c1f4b23db7ad183df8d3a
MD5 69581708d86ec10c6489065b51ee5483
SHA1 91fe71d2a355d958d826f336a880c844a72c13cf
SHA512 7931780512d21f926e193d29f39656e9d4b626487d81d58b6977054ae78d941860ecc56eb1c6ce042431471b871a0c8b0efe09b2fe40eaf5214d45ae16c585f5
SSDEEP 768:tx2YIheOWrWX5LytLNWQho0hd7NV79tIQNY:tkY/8ytxWfqd7NV79mQNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 186B
SHA256 245b5cccb3f63a8921234736a7c6f711f813bf7ff13235462255e9c372adc7ca
MD5 40ad2c07503017e074010611f301d5e9
SHA1 3ab4e85229853c9e1a46df2dcb26845de1f33e83
SHA512 5811b3f584994184d9dcb8bfaf4a49feab65e9093974020023f0569e1c510180d27331b2507e851c06e974010e313e9fa173250b812d193962e5953b15db77eb
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 ca802037815f53331bfe3c390280e9fcc31e242e0eb2845ed5d64ea482f6db27
MD5 b977cdf8a07d7c29bbaddcac89e00b68
SHA1 0a0897b01bc5cfb7cf779bc5f550f762fd11836e
SHA512 ddcca48b4fc92e3a0419a7f972e891b99eddc5418b6c89264631a216e7b5c7cc9991228205b4cf543fc3e6b2e9a4f32f99ab69f2d2ea19e77a5f6c0260f5795b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 324B
SHA256 802924e2d25199e2e85ec226180b4d444272140cba8d6e18b596fac9206476ac
MD5 71926f82e908fb4403d921b1b5627a1f
SHA1 65a40e21ed0c485818050957337817efd07273b8
SHA512 5f5ee1a5e7cfacf09f544201edec29de36cf975c4253f20492d035ac9812dbd3a4a0fdbe99cb7b94c20fe4cc8d5cff5a7ddf37c037b8f9482984c8e55c91468a
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57cd62.TMP

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57cd62.TMP
Size 120B
SHA256 dedb1f8eee5074efa9e960bdc10b1fbc34ae0fa6c01065aeac3061b4f513e0ec
MD5 2c00cd49706d8b2928153785eadda9fd
SHA1 8833d34576c27b2824066418adf29ba113e79a4c
SHA512 edb436b98fce4e77e7baeafee656f3fc7615d1ab67e96db8d05808368e39ce0054580e7c42277e608e111c29ecd86477ae3f87602f5e10a124888eda93921416
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Local State
Size 3KB
SHA256 7194e3c3e63c3c6dab6f8a6a36ed4a8bfa249e3faab817be4067902d09f9c378
MD5 8ebb94a24ef289abf8f3ac012a232409
SHA1 5807b66ffc0a0239b5ce9ef7d04fd835a96ad5a3
SHA512 a7ef04282103a225a8e4f7d6d42936b1e23b74fd4387c9b13a532c7bd551e89b904d19b19950527c5eddb758666a7f30ac8ea86f62d8a5b0de7ae0eac8e69a20
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Local State
Size 4KB
SHA256 e282de873e15410c112c823734b93a5f0532f9de9581fd227b43b5945602d55c
MD5 68759348d310a506cb9814c13031dd47
SHA1 11142c9aa2d066a673472bbbba4e5230bceb12b6
SHA512 067acf86ba4b04ce1c0dfbac873e5f1b39dfd36b303af77abaaff9a07bae97e333a5f68526089529d7273b64d085ce22e2939aa2d4fd9a8b4066c44904fc8572
SSDEEP 96:tqGNkCufcvBQXEax758Frh/cInURoDotovpA+FDZBFsvhMYyJWmzpBGa:EGNbnwEaMooDUwpN/7Y+W+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57c18b.TMP

Path C:\Users\Admin\AppData\Local\Temp\h13o2heh.csl\Local State~RFe57c18b.TMP
Size 1KB
SHA256 50b311d9aeab773bfd7950f4877266ee8308e5b85dadc32b82c476b38e6be18a
MD5 e49a3804ee0ca32e47b51bcd00ed6215
SHA1 30c012dfa5d95fedc68d7c8c05580f2804314fe7
SHA512 e006e335163407191cc324f51081c5012a14b91212866d65eac34d41a102bf30e728f4797e7a2e0dab2ce858e9d4daf99c01fa08a78932beac253429c0b93197
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\qnwdt4cl.pf3\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Crashpad\settings.dat
Size 280B
SHA256 e2200817c73409ddad0c9c3720aee6cb92431a7f2ac461730da192fc27bf39bf
MD5 94360fc6be196af40adfa678575fb281
SHA1 2ae4fa69562910ca2119adc2533c14d8ff7ba5bc
SHA512 49a490df27fbeb772f3901700ce992dfd34a1d92f29a484fb55353feb01949c82d738dcf07c52fc4339844cf0a0bef30eb6afad8548302290bf2075e2f135d29
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Crashpad\settings.dat
Size 280B
SHA256 2d4e0a94489bc52ad2f12f4aef6432aa0a9ca29b9fe54966af000861b5661609
MD5 47322b5ae5079f81499f34203278a2be
SHA1 6d6d0e27e55a9cf51f96b91afbc804f517842772
SHA512 7ac1355a82765b285d59ddb7f7e699cb9678d78803556c275322a9e1c7af2768cb10a9be82884d43d4d066515705499dc7fdbdd2852d80ae197311de8b51ff63
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 d487899269ad6e86c85fb145cc247d9d37f9912e3ff2dd69e40fefa75c9f181b
MD5 b581837ac7c9f33e254706203faa2763
SHA1 ebf37831de4272d7af03b9b5d68130d8eecc4b44
SHA512 edc530248544c08dd447850dea8169afb3feae57e5886538528e217f777a3e34d79761ed26122a94a090c87f758545fd5c83cfacb06b6afa1fd1e710f5bc017d
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 6a10552bd2425a30f75ded08b583159c7f202821e5aa3783b6d0bbd0cc45dded
MD5 34de91b2ab901298572e44ddb3371b97
SHA1 6e45aa4295e17e82b6952b6684401a115eea113c
SHA512 5a41da91281f978256dc6ffb4ad85f94fcebbb50e7d8cb297ed0a18448267c5d36cf2053dd9d8e62be09681d7c99d1fee936b3cb18e16588568471b84e978f02
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57b287.TMP

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57b287.TMP
Size 119B
SHA256 8b75205fe7589e7f62eb43d6a665657e884da4286b44812b859c3cd189a1665e
MD5 49f2473bbd6a6eeddbdf8dd3e00dd9ce
SHA1 28d322d9ca81299d158eac3e259d397f630e08d9
SHA512 fa99128945bcae51188e07d0b701abc1d3b0592b8148a7e162519d39fbcda2a434920e877355ceb23312ef153c0a61d61e5b7786fc990a9fdb729822136abdea
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Local State
Size 3KB
SHA256 c01198ce5a1926e6d89bcd8e72d03af88a536616ff0c508d4dd380d7743d1b56
MD5 9873101bafad9b79fca73a3197035808
SHA1 f8787f0ede344aa337cd0854e14ea8780ff242a3
SHA512 07ddf303cb9fe80f3a4807c96caeaf64c3265b6f23399eb013a9228ebcd8ce4cde071cac6814d57748a900efb7ba7dbf7d799980aeca967bbaac5feaf30aafcf
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Local State
Size 4KB
SHA256 85254cc840a8665eeb70c266ddee592c54101ecf992d00c03fc2d49bd6baa028
MD5 19f8edf2298323690be6ba8d48b0b516
SHA1 0cec0ce38eb4eadb2a2034a24d6f4c6c089977c1
SHA512 f8ce3e794e61ef4a056ec04befff37b33b38bcdb390f1184b7c850993b626c5d1b12d39eb43ecd564263813c8a67a2d13606f06394cc29d5d58b930776c0da82
SSDEEP 96:3qGNkCufcoVG7/58Frh/cInURoDotovkOVDoBmPI1v17AlJWYIBXa:aGNbno1ooDUwzcAILArWi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57a6bf.TMP

Path C:\Users\Admin\AppData\Local\Temp\tdbjzmym.iyg\Local State~RFe57a6bf.TMP
Size 1KB
SHA256 493214ece9b55994f20eb1e3083cdccb5ff9f143ab111f1eb539c04cd03cd5bf
MD5 70dc3234594e98cb0b92b34f981b4b76
SHA1 31dbc1aac333748d2816ed99dd79d2d2a1ab6115
SHA512 04182f41cd59de9bc4527a48c99774732653568a866b282199e221b5fac32b42b457fdb6b2175c7a116159bdb3d2af9b35028fab7e5648e64433c1be2ef92ca8
MD5 SHA1 SHA512

Submit Download

4I2JW3YZXN1FPLXQYDJ9.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4I2JW3YZXN1FPLXQYDJ9.temp
Size 4KB
SHA256 5143037aeb9586d6d6659f5f9d78096cdb61d04b028a713da0a432968f4bcb4f
MD5 1786367bf15d905ad9885572441907ee
SHA1 00fa633f266cb997ad87d6b69e9253b45508bfe2
SHA512 57b630cc3eb822dde70465d935699c9e2c7778d64fc4e161591fd3ccd1054ad1a1f9d42bae5102eb2c3ea18a5c07a76b00153cd07b2beaf572fec666e1914a74
SSDEEP 48:RU8dOvuJ6kpPfOeJ9zUoYQIdLXuHEpXU8dOvuJ6kpPfOeJ9zvYQdgdLXuHf2u:l4aO4JUoVAukV4aO4JvVdIun
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 709a3a7885858c839948e9adb8d4f777d0a096432e421aa96ebdcc4723b912f4
MD5 e4eda3563d1245796dbf1ab39adf197a
SHA1 0385de552976a643ec57109730ef5a470d70af2a
SHA512 95d7ad952f7ffae6606d7e74c032eefeb235479e16d3c1a691d522192d267bd4d43e5a966b7d56bd08be28942c2850c8320ca501615e6541cb8cfc69dfbc28fc
SSDEEP 48:V5EU8dOvuJ6kpPfOeJ9zUoYndLXuHEpc5NU8dOvuJ6kpPfOeJ9zvYygdLXuHf2u:V5s4aO4JUogukO5p4aO4Jv9Iun
MD5 SHA1 SHA512 SSDEEP

Submit Download

22e4ca41-6c17-43d4-b9a8-25d23a55bacf.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\22e4ca41-6c17-43d4-b9a8-25d23a55bacf.dmp
Size 67KB
SHA256 99d76a1c99c7308af6cb7110a586ab0d18e33c60231cda1bebab354c5293fd6e
MD5 aeaf8f14e8d82c7fd972394a9e29a06d
SHA1 00b82f9b40d4886068dfdc774bf7b24665cc1d63
SHA512 5a49c2a0fb002def27466b29f518d7f3d7b7f65b998457765bed079bfc8a8d72f65b5092768a4b7fa763f40494b9363cdfa445ea5f9a3ac6d2636f9b8b3d2aeb
SSDEEP 1536:7DSSZiXdsiZiXdsVZiXdsYbx8yyUs3xOOE2E6Z:KQbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

22e4ca41-6c17-43d4-b9a8-25d23a55bacf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\22e4ca41-6c17-43d4-b9a8-25d23a55bacf.extra
Size 10KB
SHA256 73eecfc4ccf3735533d51f5cc4f2f73fe9739774fb5089351dfe7d67808a607c
MD5 5f7d171f84c2d9f6b055d04cdaea42d2
SHA1 9549da3dddc799a9717111739bdc9a43c3f587aa
SHA512 170c51aa8716aee80d80b5fa54e8db7adb654ab3e81be684772a2a7760530d430f05966d1b12e246cf78e6f9ea1be20b449be62d57399faa7fdbbdcfbcf43215
SSDEEP 96:STWC0lwTenmY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aiutILfcBCO:S50lcBYb/7uvZ8PLgxsP5wlv1fod
MD5 SHA1 SHA512 SSDEEP

Submit Download

22e4ca41-6c17-43d4-b9a8-25d23a55bacf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\22e4ca41-6c17-43d4-b9a8-25d23a55bacf.extra
Size 10KB
SHA256 74c6874043909c91401a0fd563cb0aeb3647eb4daf243db97358d2271446439d
MD5 56154a57f12d89796de53c5306fcf859
SHA1 d690f4c77762bc1809e9b01b96eba2726cdbb0c0
SHA512 a4c5076aa712b2ac17ecd9c3595a8183ae7b647859a7b8cdd62cd338a07fee2b43ac4ee8d65f731d5cdc745a730008c5ec9b77f014d23de5b47eaf21e5319f03
SSDEEP 192:S50lWcFQiR4M4DnQYapdVxzPhWBHU4T/fKNtal31foxbLypSlj:i00cFQiUDI1JWBHU4TmanAxMSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

46e1f516-f9b0-42f0-bb24-d997b694f8a4.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\46e1f516-f9b0-42f0-bb24-d997b694f8a4.dmp
Size 61KB
SHA256 bd4c12966ab40fd6e51e502bdc5ca1d01ff884516fb8c27fb9dd0b11bbc3b5f5
MD5 9c56e0c106d4cf7fc26d200050562676
SHA1 6618b21b203a747f27ea9cc92a94b3c87d7bd4ae
SHA512 80673a6daba776a4413d4c085da08515d27e47ea566dbea58bfab05f4396fd7dd1f112379a791e22e3f885728a74f03da91859434444e5bbe65bcb76b0940db8
SSDEEP 768:3o1v8uomV0NBgbksznV8+lEcpz9tffxARyxthWTxcVOE2E6Nok2c46pN:Y1v0NBgbksjpOE2E6Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

46e1f516-f9b0-42f0-bb24-d997b694f8a4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\46e1f516-f9b0-42f0-bb24-d997b694f8a4.extra
Size 10KB
SHA256 48ae512d7f7f7c0d77521d796c42217b2aa5b30f09c3b34dcfb9ce959ae6dd12
MD5 94d6114eab64bb521286f37ad70c7688
SHA1 41802a95226178cd7bb5cc23deff7d30a06b2415
SHA512 b5a596f401b4dea7ac3b6e36a33d9e49362307c2faaf3301b25b429939200b832071b8cd213b71cc3992c4c0812c277b13da1cb8b8ec0977619c050fcac82286
SSDEEP 96:STWC2TenmY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aTutILfcBCqwf:S5eBYb/7uvZ8PLLxsP5wlutfoP
MD5 SHA1 SHA512 SSDEEP

Submit Download

46e1f516-f9b0-42f0-bb24-d997b694f8a4.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\46e1f516-f9b0-42f0-bb24-d997b694f8a4.extra
Size 10KB
SHA256 d874de44de50d934c7a933f4706f8e04a8804978c0a4a78582c3a690228bc471
MD5 d0ba1a4870f8e924b219aae9db020f1c
SHA1 363e5175d0dd62f04bc346dfd4581f33f8d41c76
SHA512 36b4ffe50b5ab70f9136e30b49a611fceeec4a5f4ae01ae60becd8e706c7810bdc4eaa35498bf64b6d9644e6d1dc4d23d6dc4e8586b3ccfe1ba1de83b90eb468
SSDEEP 192:S54cFQiR4M4DnQYapdVxzPhWBHZ4T/fKNtalWtfojbLypSlj:i4cFQiUDI1JWBHZ4TmaQAjMSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

55bbb0b7-e4ca-44fe-a89f-17723b68a629.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55bbb0b7-e4ca-44fe-a89f-17723b68a629.dmp
Size 67KB
SHA256 a98bf99168717a023d1f48a772d3d398bce2b6ae666a2d8c9da014d2249c8c02
MD5 ee82bc9e3d802d86b0781ad0896aeccf
SHA1 8ff9a1d2a174e8b8a452fada2b09d8dca603ea9e
SHA512 4a9ea6047fb452db6dbd09b38c6db08202d6a9c3284cb43505efc28308ee3cde1acbcf7028bd2d0c5c27314d29807a8180b4ad212b5b06742f613f2d2ad69ab9
SSDEEP 768:rQDpOBNvOnLk31CqggBoAIsCWh0WaVOE2E6Nok2c46pN:UDapKk31CqmAIsCK0XOE2E6Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

55bbb0b7-e4ca-44fe-a89f-17723b68a629.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55bbb0b7-e4ca-44fe-a89f-17723b68a629.extra
Size 10KB
SHA256 aa581c405b8bed604195969f60f6ccccba448c0d51f9f890cb010c34b74d398a
MD5 cb8d67aa2dffbb115b577678042ec674
SHA1 71a431ce2b8c0c400ac4aabbc4f3c67f8d5450ca
SHA512 8c96df1de18ba29047e70f2399f63aa031f719288926d8b3314de6be140c35a92db2dd25ddd39c4e2aaa2aacb60a9d866eea147dd92fb1a3b72c401acc6f7350
SSDEEP 96:STWCoTenmY6pw6lF29dt40Rh7CTvBb1d0DjMLlIrLlhTLlaXv7akutILfcBCqwvc:S5UBYb/7WvZ8PLCxsP5wldRfoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

55bbb0b7-e4ca-44fe-a89f-17723b68a629.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\55bbb0b7-e4ca-44fe-a89f-17723b68a629.extra
Size 10KB
SHA256 7319a4e8916857cbfe5d9fed9526aaab4fadf2e485ff14fb3cf52fd2121b6c1a
MD5 cb707edfe3a35c212ed49f9615d8139c
SHA1 6f0368ca32098ad20b6315f46ebeccc5017dbaa5
SHA512 ae9772a8d3ef0cef4af3a0694f187758572ea6651cf83d6a207a69b40a92804e55a2e3ce6e33b11d3e952158753d84cc9730e9706146dd066d09a54e722e1001
SSDEEP 192:S5OcFQiR4M4DnQYaVdVxzPhWBHW4T/fKNtallRfo/bLypSlj:iOcFQiUDW1JWBHW4TmalA/MSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

6c4e0d83-4a15-4112-bd3d-4ffc4b8661ca.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c4e0d83-4a15-4112-bd3d-4ffc4b8661ca.dmp
Size 65KB
SHA256 cfc33d324632a0b9802c029a4b38051c5bc34d60642e17af59243a8c8ba99c96
MD5 9935e0566feb3b1e92980e51dc0b0458
SHA1 1b4cc291a8283ee124d8860e90b763d69c185dc0
SHA512 01111d5d2765536dbd53708c4ce65a35854970a95b08f13469615b0bd0b83294ad5aa4c994a3d290197ff41bd1d8b393a05a9104e3170cf000d551519ae89d04
SSDEEP 1536:VDiI0hVBUkJT26RBMqEb3gF+oV3voOE2E6Z:8I0hVBUkJT26RMw+oV3v
MD5 SHA1 SHA512 SSDEEP

Submit Download

6c4e0d83-4a15-4112-bd3d-4ffc4b8661ca.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c4e0d83-4a15-4112-bd3d-4ffc4b8661ca.extra
Size 1KB
SHA256 696883ca3af9ed2acf22150c1ffede98a393533ac834e4be4e132036de0b6a77
MD5 ed9d0ad4ffbcc2151ed73f5887dab8d9
SHA1 02b0a6df35f6ec613f55650071cd93d7ab976703
SHA512 f4b60dba80bee3eea0ff44f766df7121fcad3eb116c4961f1d593d53ea7b899bab886350f31325d7edff07df0b60a017b5163e7ee89e04f9f0d98a9e31e9ec0d
MD5 SHA1 SHA512

Submit Download

6c4e0d83-4a15-4112-bd3d-4ffc4b8661ca.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c4e0d83-4a15-4112-bd3d-4ffc4b8661ca.extra
Size 3KB
SHA256 a2f32a7ece837523c77c439a2852ff02d79021c300ab0869ea1aaec1f0a52758
MD5 45fe4080d0996c49564391abb1666b1b
SHA1 43ae472f94bbcc80ecee92ad716eebc1d3e65d44
SHA512 4bc78f8dd10e885217d4fa4d05ded71f4e0f4d90ac33948e334ea79f3f2bf500ba099af8d1aabc78feac4c0b2e29eaf9b940349a65e3b3369dcadd3d756bb50c
MD5 SHA1 SHA512

Submit Download

7ea2a722-a299-4581-95d8-5dfbff950676.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7ea2a722-a299-4581-95d8-5dfbff950676.dmp
Size 65KB
SHA256 ef423a22c304fabfe3c14ca612f1f65dbd6bbb2096f6c854c8e6456830a3e10a
MD5 4d40d6fd0b2a7d05c1bd01abf97d2c8d
SHA1 b67b4c11e2b1144a7211be9826b1484c80bd746f
SHA512 cecb6af574a9e2946121e602f0898a43297a62fa33657453c9f9793ac62bf6a7eba58ccb35fb69803cdd45c5dc05fab5d45724d783057ad8b8a464383fd7d8ff
SSDEEP 768:NgDpiY5Z1mGL8KxUtKSVOE2E6Nok2c46pN:CD55Z1mGL8KatKOOE2E6Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

7ea2a722-a299-4581-95d8-5dfbff950676.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7ea2a722-a299-4581-95d8-5dfbff950676.extra
Size 10KB
SHA256 4f5af9561d8fd7f61133bde8922228e1918d5371bf6c7a17c58c78bca61f700c
MD5 8160b8d5cdc0849648f6444655ba7b1a
SHA1 4bc1b53658e2a9d8cde85f4da7c03f36a26297c8
SHA512 8aadf8bafe26f3ac293c0ac6a43baab66e6cd6b8775ed42c6b8ddccfeb8c264452561a1322ff63dffcf5666ce1beba2d9f3e3744a70bb55ff57ff250e8275321
SSDEEP 96:STWC01TenmY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7akutILfcBCqt:S50dBYb/7uvZ8PLCxsP5wlh4fou
MD5 SHA1 SHA512 SSDEEP

Submit Download

7ea2a722-a299-4581-95d8-5dfbff950676.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7ea2a722-a299-4581-95d8-5dfbff950676.extra
Size 10KB
SHA256 a905252d86ee7dfdc2639df215f5f3612a170baeedc5323d39c30b87b3030585
MD5 61ba7afed6a8f426f89e0350e726e797
SHA1 f9c2927ad7f277f01cf7729ffcb27f3fe7e63517
SHA512 ae809c4c41284747b1201130847a435efeb09b0cf82492cd442e5d12a99886a13180cb689f3f24ae8662c97b8e3912d819291063c51b33706a6a75bc67a77e85
SSDEEP 192:S50lcFQiR4M4DnQYapdVxzPhWBHW4T/fKNtalZ4fo2bLypSlj:i0lcFQiUDI1JWBHW4TmakA2MSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2dba6d342e7e122731904aa93911f3688ad67061a92367313746244956de86a0
MD5 b6df38b18835d4d71b273f04f4ceb18e
SHA1 78adc8790336545159d40ab351ed78f6e0b11361
SHA512 21bcee5188efeca88f87a18d42cbe633c7e1d8ea4654bb8f6931001d995f104175c97e3d6606366164966fc53439dee7de1a464dfeb12cb669209a0be177f964
SSDEEP 192:OOv5zboHWZAhyjSSbK91/66Joz0dzgCl6mSSdz:Fbo2ZAhyjhS/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7766390a516422c38e97b9a2a7d7910f3d7254bc9ec109ad6ee6fdc78e754fce
MD5 07018b37273605e2ad5de449fa277bed
SHA1 df161150e2efc9ffc44f86eb42966f75bfb4e578
SHA512 78f7df039019606993b60ed92c6d19d7ee55705ed4eb573fabdf1887cd13e080e563ac7c14a2802ed1843bc7c2ede4bc356433f906c4d1baee22929bd8263322
SSDEEP 192:LOv5zboHWZAhyjSSbMT91/66Joz0dzgCl6mSSd:Ubo2ZAhyjhU/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c5e53aac7ba10818648c8cecd6516d28d828f83fcee681c9d2ce29a03e876265
MD5 3f042194c410546b0c267e89cc74223a
SHA1 3f4725da165cd7baf1924c9cdef1c03d4b06c7ec
SHA512 a93e854ca8f579c2e1fff79ec675ee4919e8c39bc5eebf69d8c7544eb40ed2c8662ff1d19d88fba03f79f1f9740bb4a363f91ebe118622b4856855ca8be55bea
SSDEEP 192:kW91/66Joz0dzgCl6mSSdsOv5zboNbAhyjSS:ke/66JozQzgC1bBboNbAhyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 527f9feadfa49865b4d65e44ae04861e0105dd734844ffafb5470013da421e8b
MD5 c1e504e061d121a982403d3ef24c765f
SHA1 549283be66e9d27c201261709a1560dc4782cea4
SHA512 a34e8cd5619234fcf9744f12cba6fc66b1846717fbb583869686ee8a5ce7a9e8184953eb163ef7791cb418d92fce599acd09c856828de4edb16e88179e19c47c
SSDEEP 192:OOv5zboHAZAhyjSShY91/66Joz0dzgCl6mSSdz:FbogZAhyjTI/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 48fa10b642bc84273502af1915c2134a6bff845098dc8abc05e7729224c52fa9
MD5 26dd530f7d7e922b6ef464bd487c495c
SHA1 2227593d559a7200f03edf14d9aa40d02af11623
SHA512 68704cc0a7f231c8dfd97b5a2b354032f5ebdb7ddde08090f17ad211a6e226ea18d068e3570777bbd0f2cd4b774d7c3bd2146747259450c77cd590cb3ccaa83d
SSDEEP 192:kY91/66Joz0dzgCl6mSSdmOv5zboHAMAhyjSS:kI/66JozQzgC1bzbogMAhyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 73105950cba5546e80a3218676198d66203c2a3ae0d9224ea3f20c289e46b08e
MD5 cf7afd6684a07008cd4df6f647aab51a
SHA1 ca1df20e0257054d4385c9e8beb3c4671f960c0b
SHA512 e0c8098face7da8dfc5a92c3030a6d74b24576e5c70380192fe7a8c3577392a1b4de8d80604b2c2a8281d622f1a4e51356e280f6f19ded620a1cbcae1d697c4f
SSDEEP 192:kK91/66Joz0dzgCl6mSSd9Ov5zboHAZAhyjSSV:kS/66JozQzgC1bMbogZAhyjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 04fe02f93024b4ddd27329995a88cda8eea6d8b89d3a4f54882369962c9d3772
MD5 a51d70c0d1ebdf7b9a1733cd0a6f24ea
SHA1 c1c3982d16913cc4449a2215fbdc137b3d52685b
SHA512 4e6f7ab7889a791d26339729ddd39419a549ad9af9b02e9263163ff4cbec5bcc8934cd34563a2f704018dc07715252ec1619999821619c8825790df9ee4ce77d
SSDEEP 192:dOv5zbooZAhyjSSa91/66Joz0dzgCl6mSSdk:SbooZAhyjQ/66JozQzgC1be
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6493fde3bcefc154caa80fc686f296aeae370fcd68678c045f6c3826955f9f13
MD5 fe3c28674219cb120b7e4ac582ee1020
SHA1 3994d047d95d57a95ccfd1b24cbbaef21f6fd63d
SHA512 495d026f7c8122094b1e22e4e874b19d9030c8f1af76a31f67ae1f744fcd5b03d569a340fc2eaa41044192fa3e3c793dec54d3d17fdc1d11ef2469a041da778e
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5e101af529bf6da0a96033de440de62c56ce76a4ccc6572799ceca5d12a86820
MD5 22c6ee4b6af0956ef5489f86768166cd
SHA1 377af9f20158d6709e606d5f8428f997edccbbf9
SHA512 ca1066807b1c0d6b39a31a9baf7e52a415eb07216f3ad2e3c0ce46806b6e101ce1ebb9b7b366420e0874c7653ebeb68ef4546bc6d8c9ebbe9c00813b9e815ad0
MD5 SHA1 SHA512

Submit Download

0b794e95-1c41-43b7-b742-6771f10bd52d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\0b794e95-1c41-43b7-b742-6771f10bd52d
Size 3KB
SHA256 fad98c3aadb4877d04d564541e0aade50e8f7ca6cb09b5429103dc8da9231f8c
MD5 aa49aefcc4471a75c48faf7605409e01
SHA1 88b28dbb0c37226652c3154352635ee6b4d36dd0
SHA512 e543ce50a0c164e16763b243d8c568a3dae9b655058711113dae4c5c86aa22bcd6848b69c70f0cf18925bc1f1b683646cbdb2db46911729738c6f95584c8d72e
MD5 SHA1 SHA512

Submit Download

111f854b-6c65-4a53-865a-88065d46ed04

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\111f854b-6c65-4a53-865a-88065d46ed04
Size 886B
SHA256 9e280957f7236bdfd4e607f6e0914ebe9884991fa3be6bc9a21f8b9b73410e3d
MD5 46cef9421240a08433056bd9f62777ad
SHA1 e09707b6b8c7132c6b4653a8afa2847b83e7623e
SHA512 72fa511d1fb5ad2deeaa9b2780622e0ce1eb9225092f05965db2d25c68533aeac8560e4a0641d871b56ce06f2af8b391e2ea91abaf725d5f8833c3f711f5985a
MD5 SHA1 SHA512

Submit Download

2511856e-0fba-45b9-9f84-04fdd785432a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\2511856e-0fba-45b9-9f84-04fdd785432a
Size 883B
SHA256 f48e5472f50f1fadd1dec4b7581e68fa6f4cbfcb89f5293948549c9995befdc8
MD5 08fd25f1c5b2c637773579247a9d6e88
SHA1 a50965568db41139ba7517292d9f970041822ae8
SHA512 a8ab8f8010cb076d99882f07c6077dc69e24907ca50d9a54a3aeb0620237fd0b03bfd5eb473052e2c748e84655115fe40f40df5124976c81b570da063b286935
MD5 SHA1 SHA512

Submit Download

3c1ff622-6765-495a-810d-6d5b85d91397

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\3c1ff622-6765-495a-810d-6d5b85d91397
Size 871B
SHA256 4c04043ad25c577260438808796ac28d2827eedcf8449d819400af00979afbc2
MD5 194290fca17b45d31ef1283f89963be6
SHA1 809ac22dea5041c3d687c02107fdf9502b2144ac
SHA512 c41307e6be778fd36bb8bb610ae0fd32a65891416cea7f0ec1802f5bd1503b1011f3f013508eccde9c4ed08dbe7aa9be782bf8d2f9f1c0528585869809540c01
MD5 SHA1 SHA512

Submit Download

414ca1c2-ae90-4397-b87c-9f2a15570b08

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\414ca1c2-ae90-4397-b87c-9f2a15570b08
Size 2KB
SHA256 05535a5f8362d4a233b03beab5b437aae0133d8064d65f86f893614226d9597a
MD5 089267409d2a0b837d8440884c46f0d8
SHA1 64b3e1fa7d6903fd14037f6306266487d39664b1
SHA512 f4fe5fb7a7da3083e9bd080ccaa1b0ba11230248ebb61b38d3d0d492e571e089d0a249becdefacfb185853170019bb0848e59da86f950157ebd72e13eb30316c
MD5 SHA1 SHA512

Submit Download

488ac249-3457-4f23-a930-62089a215db1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\488ac249-3457-4f23-a930-62089a215db1
Size 3KB
SHA256 485c176fd76f7ff4ce2c9f782cb2131e8c906ecc1019a4054ee4703a5e47ee39
MD5 e98877a77163e9116f29fee11873af44
SHA1 f8e1a51e86db3c8260a5b766845834033c24f4ed
SHA512 82e78ce7208f0c3d238d15e24180cfd9ae7ddc5c26d5698b349d69532f86af84d7a531316dbfb89fef4542c73871bfeb830443543cf92392d26319869cf9e330
MD5 SHA1 SHA512

Submit Download

4d543d16-06bd-4ed0-8f99-e7bd569081d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\4d543d16-06bd-4ed0-8f99-e7bd569081d0
Size 3KB
SHA256 e6788d559f6508f58ef784e30865a46758171094631413b23c2f1d612bbb9bba
MD5 f145a7954a34444095bbae634dc11598
SHA1 86f2b2292313b3f8a3598612a7ec4568322bbb5b
SHA512 b30901b88a5910223f63299924de9a7f78c6a404caf8aae861b399416e07527377960220930b5ceaea14dad040b7480701a96853485bb9b6781e85b4072a90f7
MD5 SHA1 SHA512

Submit Download

5492786a-cc55-4653-83d3-2affae0ba3c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\5492786a-cc55-4653-83d3-2affae0ba3c3
Size 235B
SHA256 eee1b09279a59e1786acf68abab2257ca5791836ba30432b82d5bd77a6827503
MD5 4ff87fb9c0a1e179b455976b5c026a99
SHA1 18bc359a3d5e784e4d7b89cff1e9313233707f97
SHA512 793aed269bb65c88500394552a0a6febe05ff26949ca8d1b64ca6aea3a86669f77fea0925897eb81ea3f8e0738eccb30706969e691d87c31e79be52ab20a1057
MD5 SHA1 SHA512

Submit Download

609d5b50-01d0-47f8-920b-fe352ac7b163

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\609d5b50-01d0-47f8-920b-fe352ac7b163
Size 3KB
SHA256 2717061b4169f1ca883b007cdd3de8d6f4966d44b8928b23ed2ca2d40a44291d
MD5 078f1000632de8ff2dde64ff0755b9e9
SHA1 a003179c85a2596569b40f50570fe4ae31eb6355
SHA512 f4ef091d3b2b7a2e4d919999a221be6796aa94b02a6b14909bafea4e221c2b067c70b5b00bc4b95f091d1b813f609d13b0eff1d185b2ba846d4f48a8ea8bd49b
MD5 SHA1 SHA512

Submit Download

7cc021b5-ad98-475a-aaa9-7114b4e35292

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\7cc021b5-ad98-475a-aaa9-7114b4e35292
Size 235B
SHA256 4e988cea785caa2a3e8dcce2c10d986b2c2ae90ab85cf3f3387a35ebf0bdf3d9
MD5 46f01db401a2660ebfd3067e6363ed4f
SHA1 51387c7b17affcd9d1f6610d36a066dfcc077b39
SHA512 e61ca3b0253372bdfa5b566604bac7cba2bf0dbb0db75469a902ae840e8baab488674b9d293c4bd6f99301fcfa47605ab63d8a275c9503ebd5da096c9a290d93
MD5 SHA1 SHA512

Submit Download

83b7ec19-cbfc-4f4d-8f56-c79b6aaa4f61

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\83b7ec19-cbfc-4f4d-8f56-c79b6aaa4f61
Size 3KB
SHA256 8fc62885c3d2dd1985c744f0ee4f91db18bb5fb7ecaeb1e51790098ec2fc5e00
MD5 6e1cab180d70fcb484bdfab035a27dca
SHA1 91e198970cf74293ba28e40a5a841fd24a2aade1
SHA512 ee0a902909b06d02b7f759b8a588b79203d140e9fdc59d667d6b200292dc1c4ce2afd31d41de75ce8590b1bdf4ed968c94bc2795be14e274c630a7fafefaa3db
MD5 SHA1 SHA512

Submit Download

aa943bd6-bd68-4a4d-aab8-81dd0f0f7453

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\aa943bd6-bd68-4a4d-aab8-81dd0f0f7453
Size 3KB
SHA256 bb4b219e3d04dede9d679c8333170c15f109a9c4371c059d9be899106ff02214
MD5 54a0947e7345dcd58d8fa6c07292535a
SHA1 637e548f32e55699c24d9caaa24db50cc7c66208
SHA512 38b0e523e83949355e4a1d7badb658bd61c8411b5e6ba57a0b75d07c45764877b19382b05476f89450198a24555baa068f82c238ea9f976e94bd1c36861b784e
MD5 SHA1 SHA512

Submit Download

af28e3d4-fb3b-45ae-a6ec-5f66ac0f5936

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\af28e3d4-fb3b-45ae-a6ec-5f66ac0f5936
Size 3KB
SHA256 368abd0f3a5de5281523b70a71a6f80b28200063457496d29dc135f56209270a
MD5 f1572945abd6b8bb673b1a7f5e1aeffc
SHA1 1690b151a3b3827978b49db4c97088b6e2aacff4
SHA512 8a11b0525ac34342b6277bd785442a765e5e3d51384e6949c2f5760802b5e96d8d5e2c7bae9d4299052f685b6e9d3d34ab693c8bb033319a3777666c89318a2f
MD5 SHA1 SHA512

Submit Download

b6c7d067-4ddf-48c0-aded-5fd5455ec849

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\b6c7d067-4ddf-48c0-aded-5fd5455ec849
Size 235B
SHA256 4ead017bc9d8bf4f8655a82c86c8362ab7b1cad77af615f7915c139cd0a5449e
MD5 33f30684c890e28fbe398f7851e0008e
SHA1 5ec4403f72278219b914b4cab9a8286b23281404
SHA512 479fe6f2706973d6bd38b5c113e02dc9fbdd6789aeb6248e3776640bd00a45d230c89e6ddec0c3ae39ead3729287e0cd2247f902f624d5c546aee12acba90335
MD5 SHA1 SHA512

Submit Download

ba30d77f-b4fb-4ef1-882b-66c905a0a8f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\ba30d77f-b4fb-4ef1-882b-66c905a0a8f0
Size 3KB
SHA256 068d81e7c37754d26da7499e59bcb87e9e1a092ea87fd852d0ed9f5e964696d7
MD5 86bdf6b67da0187a3a673e503a9e154e
SHA1 33ef1500ad8308436e068bdfed2d0f7a628b166c
SHA512 b82361a2172a08d32062a3d85c6f6ec5f169149f2a30052d37dcc221507fd0a6028a6658504fca0ab7144677cc1807c6d6f9d8f7a8197515e6790732fa625277
MD5 SHA1 SHA512

Submit Download

bbcd1938-5133-4a53-9c9a-9cca1cee7773

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\bbcd1938-5133-4a53-9c9a-9cca1cee7773
Size 2KB
SHA256 744e73d1d9f0f8724a17cefac3c3256f6892b6430ed9b0f4cf51ce407ca5a627
MD5 3b1f8c419ae79bfe70daf81ba9f014a6
SHA1 7ae411a72c5322ab0347d0186b77d7a6952af270
SHA512 92949cb62929582907f588f491d5b61f1aeffdad9e72d316dfdd1b51eb7c9d995516e8136825ac91403cacebf6dbf01ad0002ed8b66a4c3cc36a613c551b2654
MD5 SHA1 SHA512

Submit Download

de165eee-7ec6-495a-8d79-337e061a5db6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\de165eee-7ec6-495a-8d79-337e061a5db6
Size 17KB
SHA256 b1e17c532fe26ba5cdc937ae766a182535972f79f546d6a60b44fafc94f34249
MD5 643ebf7e436722ef56ab4b97c172c765
SHA1 da6186c7f5199674f36a48066e237a06d23142f8
SHA512 428e539cd855f1b37ec92ed2b2161bc1f7307ebd4af3f4ddb87bc1ba9ad6442ace71f89a9db25e1ac68af36dc1cceb51abf2cfe9305f47b2a3ef346f7a542df3
SSDEEP 384:Vgh6Wk6nqKPQdkHGKLDam7xbBiYBlUWAL:Vi/k615mKzlNAL
MD5 SHA1 SHA512 SSDEEP

Submit Download

e83e7c15-eaa4-4ceb-b960-2c957e9e9144

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\e83e7c15-eaa4-4ceb-b960-2c957e9e9144
Size 3KB
SHA256 afa8ae952af66ac0ee22e77f306e535df817bd912149a0725a192d7b2a211415
MD5 1379fdd7fbcf724c8082f14c29242f28
SHA1 22cc96bfae3f854ef3ecee061a78ea0d9f6f8ac2
SHA512 56d73c32b694a0fdd2c6139056814f7076c90bacccbd9e40cfee3e27d25d6569b676e29cd631462f70d8cbd2e587b5dbabc7a851d8bd8972e4b6fd1e3bc009e7
MD5 SHA1 SHA512

Submit Download

eb948d77-4d1b-427f-baf6-dea2207819e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\eb948d77-4d1b-427f-baf6-dea2207819e0
Size 886B
SHA256 e16ec641824b60b505b8e7cea4ebd7b6d54cc4205d1345810cda99c042962e11
MD5 9ed9b273abe71ac86c2df5ba778cbb79
SHA1 418f10a05f17be804ce47d5e364c4e51672bdb7d
SHA512 d367b97d8871bdee227cc200dbc897a25d7a9b7c33f865e8b9a8d6267708e4558fcdd644e0bbbd89b45bbb99c8dc1f40968cd006661adc29ef8c428e0bab9e5b
MD5 SHA1 SHA512

Submit Download

f8e2aa1d-7527-43f4-8638-8a6fa5545fd2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\f8e2aa1d-7527-43f4-8638-8a6fa5545fd2
Size 235B
SHA256 eceecf7572aa4d4ac117a79573fa86d9cb8aa77fa5c326509b0e882c57583ed5
MD5 8ac646c9518402299c5f3c19bf3579ec
SHA1 689b5d65c7e640bee4398c8e59ceacdde6092c62
SHA512 627dd887125ab9e694450b356e4d0dcb33e49ca54eb1ee3c127703eeccab4842ea14bd1a27a082e34d8b5f2ed4330b360ed170e5b5ab7e2c00d662861b9ff4c0
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\prefs-1.js
Size 6KB
SHA256 d2a7b2b9c76757c060162cea8b6f88bff551370bcf4064557442b7bfadd39c3f
MD5 17b6e8c1dbfd6c67393a3706552f8f3e
SHA1 ea532f16df58ec1ca813fa6c93163ca9d82d9f65
SHA512 20b629105fb4f9f5cd0f873f58fb85928af3eb667afe787ab3a901948de550dac738d3f7ad43af75eb4c03e8490209fdee4dbaeebda07cc407b138a6fcf25ec1
SSDEEP 96:xHMUTUykqGqJffKKn31zS+SSlhdv9jGntSHattLKBw88H8L4cnpVmComgcY:iCXRJfft37SSPsLKBw88WgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\prefs-1.js
Size 6KB
SHA256 cd6cc516071e84105d3529e4d799f778d00e81eb06d9dcfc0b16d087a8754959
MD5 68978e7238b2d97f43e6a77ada5fdfa1
SHA1 4aa543a636b2b43479f0d8b600b140ce6e57b88d
SHA512 da67145913535d25ad1cb9f378a6c150fea0e33ce74d21a72e9c7873bf0e4e16bda262c9d97f131b670b36c86fac83e56eb1bfe2f1f8fd1baae7a88fafdfe7f9
SSDEEP 96:xHMUTUykqGqJffKKn31zSDSSlhdv9jMfntSHattLKBw88H8L4cnpVmComgcY:iCXRJfft3qSSYysLKBw88WgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\prefs.js
Size 6KB
SHA256 0d02e112b12c23df7cece97fc2d33cddb94c0282b840baf373af7e68712d5723
MD5 a3d56cea9f0e36f90c0c692d7a43d8f7
SHA1 e84176be7b5bc7887894233e7c9a100d2e057e28
SHA512 01fbaae436153d0a83b0cbe2cc4a00fb7ec342e3c05138b00be69a315ab7a8d8e13dadc6985793c851ec23ce38f9da0b1756a5ab2b067a7af90e5a280f236d6d
SSDEEP 96:xHMUTUykqGqJffKtnI1zSNaGSSlhdv9jbpntSHattLKBw88H8L4cnpVmomgcY:iCXRJffmI+aGSSYsLKBw88Wgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

dpnhupnp.dll

Path C:\Windows\System32\Container\dpnhupnp.dll
Size 28KB
SHA256 5cf4a8d9233ae1033788efe8f1296ffe64a314e1c38ccca33fbcbad8f3db4a7f
MD5 e750ca03b67b1b50dace1875cff645d6
SHA1 bfcb9780a6357e53c414d96d56291c4eba67cd88
SHA512 e735db461bb583ef07f4a5c69c6b38cb4a6d5782cda587ba55ad3ccd49a048e29cf3dac53824db4c48ae95760b5fe8e841f5fb6430e5f6261d6a9ccf4bc6c318
SSDEEP 96:rel2VLEi2Q46yNk59Mv8mVsY7YazvZ5DsmMWr7b5GEWquWw:ryPyyNk5GzXYSvDxr75WquW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2364-1878-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2721-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2720-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2719-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2718-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2717-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2726-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2727-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2728-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2860-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2861-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2730-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2731-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2738-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2739-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2740-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2741-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2734-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2729-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2722-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2655-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2656-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2668-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2669-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2670-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2671-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2672-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2673-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2674-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2657-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2664-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2660-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2651-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2654-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2242-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2600-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2250-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2251-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2253-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2260-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2261-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2262-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2263-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2264-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2269-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2270-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2271-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2272-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2265-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2266-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2254-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2255-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2243-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2244-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-2245-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1877-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-0-0x0000000000700000-0x00000000007BE000-memory.dmp

Download

memory/2364-1904-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1914-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1915-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1918-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1919-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1920-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1921-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1916-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1906-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1907-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1905-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1893-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1894-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1895-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1892-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1879-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1876-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1821-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1826-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1829-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1828-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1823-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1820-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1707-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1706-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1778-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1800-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1792-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Download

memory/2364-1793-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1775-0x0000000000A80000-0x0000000000B80000-memory.dmp

Download

memory/2364-1556-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Download

memory/2364-1466-0x00000000066A0000-0x0000000006BCC000-memory.dmp

Download

memory/2364-1464-0x0000000005ED0000-0x0000000005F20000-memory.dmp

Download

memory/2364-1463-0x0000000005E50000-0x0000000005EC6000-memory.dmp

Download

memory/2364-1462-0x0000000005FA0000-0x0000000006162000-memory.dmp

Download

memory/2364-1096-0x0000000005D20000-0x0000000005DD2000-memory.dmp

Download

memory/2364-171-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Download

memory/2364-151-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

Download

memory/2364-117-0x00000000053A0000-0x0000000005946000-memory.dmp

Download

memory/2464-1714-0x000001AA5BD90000-0x000001AA5BD9C000-memory.dmp

Download