phantom_stealer | 68358632af8885e3e550eb075c1bc1b2f38e2366fc8e2c19c8fb065865b174c3

Analysis

max time kernel
150s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
01/12/2025, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
comprobante-swift.0078-887.001_pdf.exe
Size 1.2MB
Sample251201-vgxpdatlcr
SHA256 68358632af8885e3e550eb075c1bc1b2f38e2366fc8e2c19c8fb065865b174c3
MD5 a848d737c34fc0a40696347089efa6ce
SHA1 0735cd36b4f17312b8ad79d06f0cd9cfafa5aa5e
SHA512 301442b013e21f23b0e793eb1d9e8536853a5c9ad4ae6c783b6b6aca60626f20a2736eed8819a8b850ee83ecb976793e2519118a825de8fccfda4c798e78e341
SSDEEP 24576:ZDC6EZ2f1j42HTb94t3KsM58SqMhbjVUYoSSMVgf/TV+L:Zf19dI3K4SqMBjtSQs/TgL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8072853303:AAGghafG-r5USRhbAxPCKYRIj0BdxMT-V8E/sendMessage?chat_id=7899117178

Mutex

KILRDF9ZMHFX38W2R8IE

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/3332-9-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	icanhazip.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4456-6-0x0000000005A30000-0x0000000005A3E000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 3332	4456	comprobante-swift.0078-887.001_pdf.exe	79

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comprobante-swift.0078-887.001_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134090819237975236"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4456	comprobante-swift.0078-887.001_pdf.exe
4456	comprobante-swift.0078-887.001_pdf.exe
4456	comprobante-swift.0078-887.001_pdf.exe
4456	comprobante-swift.0078-887.001_pdf.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
2484	chrome.exe
2484	chrome.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
5968	firefox.exe
5968	firefox.exe
3332	RegSvcs.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
3332	RegSvcs.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	comprobante-swift.0078-887.001_pdf.exe
Token: SeDebugPrivilege	3332	RegSvcs.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	2484	chrome.exe
Token: SeCreatePagefilePrivilege	2484	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe
Token: SeShutdownPrivilege	564	chrome.exe
Token: SeCreatePagefilePrivilege	564	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2484	chrome.exe
2484	chrome.exe
5392	chrmstp.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
5968	firefox.exe
688	msedge.exe
1892	msedge.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
1036	firefox.exe
564	chrome.exe
564	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5968	firefox.exe
1036	firefox.exe
3332	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1468	4456	comprobante-swift.0078-887.001_pdf.exe	78
PID 4456 wrote to memory of 3332	4456	comprobante-swift.0078-887.001_pdf.exe	79
PID 4456 wrote to memory of 3332	4456	comprobante-swift.0078-887.001_pdf.exe	79
PID 4456 wrote to memory of 3332	4456	comprobante-swift.0078-887.001_pdf.exe	79
PID 4456 wrote to memory of 3332	4456	comprobante-swift.0078-887.001_pdf.exe	79
PID 4456 wrote to memory of 3332	4456	comprobante-swift.0078-887.001_pdf.exe	79
PID 3332 wrote to memory of 2484	3332	RegSvcs.exe	81
PID 2484 wrote to memory of 3852	2484	chrome.exe	82
PID 2484 wrote to memory of 5872	2484	chrome.exe	83
PID 2484 wrote to memory of 5796	2484	chrome.exe	84
PID 2484 wrote to memory of 2528	2484	chrome.exe	85
PID 3332 wrote to memory of 2484	3332	RegSvcs.exe	81
PID 3332 wrote to memory of 2484	3332	RegSvcs.exe	81
PID 2484 wrote to memory of 4380	2484	chrome.exe	86
PID 2484 wrote to memory of 4420	2484	chrome.exe	87
PID 2484 wrote to memory of 1992	2484	chrome.exe	88
PID 2484 wrote to memory of 1988	2484	chrome.exe	89
PID 2484 wrote to memory of 5592	2484	chrome.exe	90
PID 2484 wrote to memory of 4988	2484	chrome.exe	91
PID 3332 wrote to memory of 2528	3332	RegSvcs.exe	85
PID 3332 wrote to memory of 2528	3332	RegSvcs.exe	85
PID 2484 wrote to memory of 3680	2484	chrome.exe	92
PID 3332 wrote to memory of 3852	3332	RegSvcs.exe	82
PID 3332 wrote to memory of 3852	3332	RegSvcs.exe	82
PID 3332 wrote to memory of 5872	3332	RegSvcs.exe	83
PID 3332 wrote to memory of 5872	3332	RegSvcs.exe	83
PID 3332 wrote to memory of 5796	3332	RegSvcs.exe	84
PID 3332 wrote to memory of 5796	3332	RegSvcs.exe	84
PID 2484 wrote to memory of 5524	2484	chrome.exe	93
PID 3332 wrote to memory of 3680	3332	RegSvcs.exe	92
PID 3332 wrote to memory of 3680	3332	RegSvcs.exe	92
PID 3332 wrote to memory of 2484	3332	RegSvcs.exe	81
PID 3332 wrote to memory of 2484	3332	RegSvcs.exe	81
PID 3332 wrote to memory of 2528	3332	RegSvcs.exe	85
PID 3332 wrote to memory of 2528	3332	RegSvcs.exe	85
PID 3332 wrote to memory of 1988	3332	RegSvcs.exe	89
PID 3332 wrote to memory of 1988	3332	RegSvcs.exe	89
PID 3332 wrote to memory of 3852	3332	RegSvcs.exe	82
PID 3332 wrote to memory of 3852	3332	RegSvcs.exe	82
PID 3332 wrote to memory of 5872	3332	RegSvcs.exe	83
PID 3332 wrote to memory of 5872	3332	RegSvcs.exe	83
PID 3332 wrote to memory of 5592	3332	RegSvcs.exe	90
PID 3332 wrote to memory of 5592	3332	RegSvcs.exe	90
PID 3332 wrote to memory of 4988	3332	RegSvcs.exe	91
PID 3332 wrote to memory of 4988	3332	RegSvcs.exe	91
PID 3332 wrote to memory of 5796	3332	RegSvcs.exe	84
PID 3332 wrote to memory of 5796	3332	RegSvcs.exe	84
PID 3332 wrote to memory of 4420	3332	RegSvcs.exe	87
PID 3332 wrote to memory of 4420	3332	RegSvcs.exe	87
PID 3332 wrote to memory of 3680	3332	RegSvcs.exe	92
PID 3332 wrote to memory of 3680	3332	RegSvcs.exe	92
PID 3332 wrote to memory of 2484	3332	RegSvcs.exe	81
PID 3332 wrote to memory of 2484	3332	RegSvcs.exe	81
PID 3332 wrote to memory of 2528	3332	RegSvcs.exe	85
PID 3332 wrote to memory of 2528	3332	RegSvcs.exe	85
PID 3332 wrote to memory of 1988	3332	RegSvcs.exe	89
PID 3332 wrote to memory of 1988	3332	RegSvcs.exe	89
PID 3332 wrote to memory of 3852	3332	RegSvcs.exe	82
PID 3332 wrote to memory of 3852	3332	RegSvcs.exe	82
PID 3332 wrote to memory of 5872	3332	RegSvcs.exe	83
PID 3332 wrote to memory of 5872	3332	RegSvcs.exe	83
PID 3332 wrote to memory of 5592	3332	RegSvcs.exe	90
PID 3332 wrote to memory of 5592	3332	RegSvcs.exe	90
PID 3332 wrote to memory of 4988	3332	RegSvcs.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\comprobante-swift.0078-887.001_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\comprobante-swift.0078-887.001_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa375ddcf8,0x7ffa375ddd04,0x7ffa375ddd10
      4⤵
      PID:3852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1840,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      PID:5872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --field-trial-handle=1996,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
      4⤵
      PID:5796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --field-trial-handle=2144,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
      4⤵
      PID:2528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2860,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2872,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3372,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:1992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3424,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:9
      4⤵
      PID:1988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3064,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3444,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:9
      4⤵
      PID:4988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4004,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:3680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --field-trial-handle=4408,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --field-trial-handle=4900,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4960,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:2172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4988,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:128
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:5800
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff60c481f58,0x7ff60c481f64,0x7ff60c481f70
        5⤵
        Drops file in Windows directory
        
        PID:5144
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5392
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff60c481f58,0x7ff60c481f64,0x7ff60c481f70
        6⤵
        Drops file in Windows directory
        
        PID:5336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4976,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --field-trial-handle=5068,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5116,i,12248144580423617303,110503024629750465,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dq35opk5.sw2"
    3⤵
    PID:5564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dq35opk5.sw2
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5968
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {a1bd8fdf-7f43-47b5-9500-0ea887ff2270} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:3912
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {2129cc80-b9a2-4533-a42b-6efee2e73ba1} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:3940
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\48661061-c45f-4e03-9cfb-212d6ea32b08.dmp"
        5⤵
        
        PID:3712
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2848 -prefsLen 27133 -prefMapHandle 2872 -prefMapSize 270279 -ipcHandle 2324 -initialChannelId {6586ce4b-4eec-4b54-a32b-25aa24552024} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2560
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9ef5c6f-3552-4d57-b5c0-c8445798aa66.dmp"
        5⤵
        
        PID:5148
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2988 -prefsLen 27133 -prefMapHandle 2976 -prefMapSize 270279 -ipcHandle 2900 -initialChannelId {21c818e5-1b75-4ef9-9b40-6822cdbd7ee0} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:564
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec9e35b6-a1fb-4bbb-b56d-6d933d8738d8.dmp"
        5⤵
        
        PID:2896
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2988 -prefsLen 27198 -prefMapHandle 3468 -prefMapSize 270279 -ipcHandle 3448 -initialChannelId {1ac9c66b-5b4d-4ccb-87b5-b2856ceb018e} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2176
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27323 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {982a7444-00e4-4a20-a858-215148f8b22f} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1480
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0133374-b1bf-4c9d-92bb-928c69b4211e.dmp"
        5⤵
        
        PID:1512
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3448 -prefsLen 27323 -prefMapHandle 3620 -prefMapSize 270279 -ipcHandle 3540 -initialChannelId {96a269b5-4ff9-4c2d-9548-2a656ebf7584} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:3976
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71dafb6d-2843-48c4-8b8e-c1410fd59683.dmp"
        5⤵
        
        PID:3492
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4260 -prefsLen 27323 -prefMapHandle 4264 -prefMapSize 270279 -ipcHandle 3844 -initialChannelId {c519c480-a9f3-4648-978a-24528fdea229} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5232
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3164 -prefsLen 34822 -prefMapHandle 2936 -prefMapSize 270279 -jsInitHandle 3260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1568 -initialChannelId {9739af08-4015-42d3-b73e-b66ea4329512} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:3140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2320 -prefsLen 35010 -prefMapHandle 2756 -prefMapSize 270279 -ipcHandle 1660 -initialChannelId {f312db32-fcbd-4dd3-949f-3434bd77ec69} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:3404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 32952 -prefMapHandle 5064 -prefMapSize 270279 -jsInitHandle 5068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {3e9e623f-36d0-4817-b93a-622f3b0322af} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:1096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5316 -prefsLen 32952 -prefMapHandle 5320 -prefMapSize 270279 -jsInitHandle 5344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5352 -initialChannelId {d78294c1-7e4a-4a35-a225-a49060b32c06} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 32952 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {770786a2-c3b8-4654-a764-37b02e99fccf} -parentPid 5968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffa24c7f208,0x7ffa24c7f214,0x7ffa24c7f220
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2200,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=1824,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=2276,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3052,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3060,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=3268,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:14
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=3276,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=3316,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3332,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3440,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:9
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3468,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3536,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:9
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3576,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3612,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:9
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3656,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3672,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:9
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3708,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3740,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:9
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=4396,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:2204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=5012,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=4408,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=5164,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=3416,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi" --always-read-main-dll --field-trial-handle=3920,i,12150337498411941412,3758086579621291903,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
      4⤵
      PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ffa24c7f208,0x7ffa24c7f214,0x7ffa24c7f220
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2204,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=1832,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=2252,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:13
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3024,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3008,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=3248,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=3264,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=3272,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3396,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3424,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:9
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3452,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3484,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:9
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3508,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3568,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:9
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3584,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3596,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:9
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3664,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3696,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=3732,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:3520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=5192,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=5228,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=5324,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=3936,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue" --always-read-main-dll --field-trial-handle=5068,i,6717974330717463467,10239088669998032982,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:14
      4⤵
      PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3i32tycr.4m2"
    3⤵
    PID:1388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3i32tycr.4m2
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270331 -ipcHandle 2036 -initialChannelId {9b8a4b35-330b-42b2-b8a7-d71e5422565b} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1216
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2324 -prefsLen 27133 -prefMapHandle 2308 -prefMapSize 270331 -ipcHandle 2396 -initialChannelId {5f383558-82ff-48e2-ac9f-d59e08807f72} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:6116
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e20fb98f-9fd0-4864-9681-01b7dfdc8a31.dmp"
        5⤵
        
        PID:3760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2116 -prefsLen 27133 -prefMapHandle 1404 -prefMapSize 270331 -ipcHandle 2704 -initialChannelId {097793e1-f1e6-485b-8a40-59aa027cef3a} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4444
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\51bf6bcf-7d3f-457e-9f8f-06222167b160.dmp"
        5⤵
        
        PID:3100
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3176 -prefsLen 27133 -prefMapHandle 3188 -prefMapSize 270331 -ipcHandle 3260 -initialChannelId {347ca677-c770-4f7c-b5d5-747ddfb5bd2b} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 27323 -prefMapHandle 3864 -prefMapSize 270331 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {c1565662-052c-4bba-a609-71bf0bc8a49a} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:5920
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9fa8fabe-cc5a-4094-a88b-e516fc35ccbb.dmp"
        5⤵
        
        PID:5032
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3260 -prefsLen 27323 -prefMapHandle 3812 -prefMapSize 270331 -ipcHandle 3476 -initialChannelId {e8424784-69d0-4c76-9642-95e6f3a2f8b8} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5008
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1caf265f-2b71-41da-8e28-9238ab986ca2.dmp"
        5⤵
        
        PID:2840
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4272 -prefsLen 27323 -prefMapHandle 4268 -prefMapSize 270331 -ipcHandle 4304 -initialChannelId {9dbcc4fc-d470-435c-a092-48bf392879f4} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:6140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 34876 -prefMapHandle 4512 -prefMapSize 270331 -jsInitHandle 2396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2404 -initialChannelId {ce7ed4a7-6b8f-48f1-aeb3-2e29e40d68de} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:3740
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4684 -prefsLen 34876 -prefMapHandle 4680 -prefMapSize 270331 -ipcHandle 1676 -initialChannelId {ecfe1a2b-b3e1-4931-9076-5e1a614e2c51} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5280
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 32766 -prefMapHandle 5064 -prefMapSize 270331 -jsInitHandle 5068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4684 -initialChannelId {4147f87c-063b-4581-8f3d-31e953e30f4e} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:5936
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 32766 -prefMapHandle 5244 -prefMapSize 270331 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5256 -initialChannelId {6b5ff49c-3f33-4daa-8097-160b6a81d53a} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:4548
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32766 -prefMapHandle 5444 -prefMapSize 270331 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5456 -initialChannelId {68b9eabe-403d-430d-a92c-7f5a78f0ecb8} -parentPid 1036 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1036" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa375ddcf8,0x7ffa375ddd04,0x7ffa375ddd10
      4⤵
      PID:5140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2244,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:4552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --field-trial-handle=1792,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      PID:2564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --field-trial-handle=2036,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
      4⤵
      PID:3456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3512,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3556,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:9
      4⤵
      PID:6064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3588,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3620,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:9
      4⤵
      PID:5248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3744,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2kjaddd4.swz" --field-trial-handle=4356,i,17511466399497608523,12689426613396359298,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5392_13409081924311780.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5392_13409081924311780.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
MD5 SHA1 SHA512

Submit Download

5800_13409081924343520.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5800_13409081924343520.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.contile.json
Size 4KB
SHA256 bbb0d8de45b320be14649da367e0e9238b42b3e46e4894d88b78bed01585f0d9
MD5 784b441ef905f4a192cf09a1ef9cda4f
SHA1 d0b9779ddf8cbee081c07db1d2eb983089f615c8
SHA512 e4fac4e29c170ab52aa8fe167d56cba4e96485ab0fd56e3469662dc5b7f89c0aa2e98c1ff3f1ea02cffa777dc55c456034ea0e4ba560cb60547b9d0cbd9c5bda
SSDEEP 96:36SGtLMCndJYKYXQ5Es6DBlOoLrtl3ZoqQRol:ktLMCdJ6Qqsw/hLrxIGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 2474716f8c26cbad115cbfd2c1ce2b31c089fc3235a8f317b6a5ce2009c12814
MD5 e6c96c5bdbc360d45b58a392fcb35b3c
SHA1 904e514da776e363be516097db8fdac1a56f4886
SHA512 6e03274f715b7d5a97745f72dabac390aeae5de0accb0bfcb119515d8c7d9e3066bf749bffef872a768dbd88149649e0395e6a0d0803bbe151061d261ac290c8
SSDEEP 384:6yayQlEf4GS5EKkeo1EkHXM1/ZElvYZ1Byga1vRnGHmJPiSIoX0aZACW:6y8yKka4XM1/qiWga1JZjZACW
MD5 SHA1 SHA512 SSDEEP

Submit Download

7DA1EAB87BEA9BEBEBABCAC30A570208E2B830C2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\cache2\entries\7DA1EAB87BEA9BEBEBABCAC30A570208E2B830C2
Size 14KB
SHA256 c78aeef50ff9646d58af85a3618910132e6a985dd5b95adf5198432a203c838a
MD5 4bcad727cc7a54054a049f658b161851
SHA1 fbd733ba73b54c56adc4874b9fb99ab467c99021
SHA512 a224e448852175f2c15682c1462626762aac6d2a91d882a4210c7d44face46efe0a1a8b56176b7619dc268f3d00db62157ff410667aeaba190a39fd88097ee81
SSDEEP 384:H3LfiO024YH7hSznZOML+CbcxDEclrIVy8e6G4:X+ZYH7hSz8MLPbcxDEcVIVy8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 d77d0e945ddb31d760e4ff6636b51269c1434da77f70f33d5fee66bf8f16b7f9
MD5 07bebf21a33261e36d1514d1115a4ec4
SHA1 6648f62a7013e97e8b9cbd2813fb976cea7b1fde
SHA512 0642ea5358b9f5e0f7af2fb2f4ae49cac09c7edfe63c061574f38d45a9401abc2a451e0fe78025d22b147e97a7c5d112fc1533ea110cf93915adcf92a93b4f82
SSDEEP 1536:jTrliXL/DDCh6MTAOmVcIi0kLWETExSPf5S7a53K0oLkpsZw3OFhZ9UyXEjQv7sQ:j3lPh6MTMUhVTEkxzpNOx9U70sqdJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 f18dcb72e3b35b082a4ff8e36897a0e571eea9ce3faa4df01c25db03e242cadb
MD5 2e53a0da3d561ad9fd7d70f2797242d3
SHA1 74c07d8e040d385168885859ebb084dbcfc278f3
SHA512 2128a52cd3e8ee8d6485742324409e716cffec6f0a404178d6ebd532948ee6a9b973515a5d68d4f787b914f18427b99d50fd86b391f6e1d9a757bd8eb4bfb0b3
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 1957de0f0d150691cf50136cc8af5557c69594578292632284981dc90bcf20c3
MD5 d6b943b4b8bbeb32f00a8874ef1e706f
SHA1 5f1666f9f8546e8e044b01f98753016d31467203
SHA512 2dd204e93ab1d6847d3ef182ee35dc9dcc78c5e807d5881aa562f407c7a78a08bdebd0007bc836970691740398dd567e13bfcd256ec07b97a13a26f046675b1f
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 26ef3a9f36aac1eca1805249a02f749d420c7d1513847adb25a2e4ec887bd17e
MD5 5de2b8db0c9986b3eee601b1009ef623
SHA1 9a267178a3ecb89904d1f6a973a659f9ff8dee61
SHA512 1e3e4cc7f663dd47a7ccbf4721f7a0f28eed3df8b5193492279217e30a8b1330131625a1e2030e923a3914593097b700fd2073be66dfda315f38e785fc97f264
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\5coe43jt.5ey\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Crashpad\settings.dat
Size 280B
SHA256 28aab45c373976d3dfa309f055ec0ffd7ad2df1fb856f0faa757bc40cb294a11
MD5 3765368e306ead393aa0eebd372c85f7
SHA1 f5d6631abcb93ca7e489fcfdd428e84ae61e768c
SHA512 1788eb9962b3526954af3c213074bf06c583ab79fe0326448ca75153ada3463618a8016ca9c0a3cd5dd1d6615fb2d9cb6908a211effd951109ddc40c38dd8e88
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Crashpad\settings.dat
Size 280B
SHA256 7230dd4fbc95bd0c22505c4c14680f772f0e163b9534ecce477e03e60e817325
MD5 aed115b780c1c7bd0f21f7faddc98e3f
SHA1 89aeca937186986fe2b8a044e40da32ace6f479b
SHA512 85d63dca1e6c4ad3766677e4b1c971aed9c01a30a0456bf3440bb786911cb5bb6f403ae2c7d9a6e6ad7259f414f1c82c297f6727dae01bd84e22c5e45b0a98cd
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

37353660-9dfb-44f2-8b6d-6eb248a87950.tmp

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Default\37353660-9dfb-44f2-8b6d-6eb248a87950.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 437ae2003e2444403f68a6197870345c38d8722f0ed942bdc0174c65e0a48664
MD5 5e16e9318b36e655aca3ee15386602c2
SHA1 e9e93d6dc0bee7bb6a583310eb2f3ce5ed6960d2
SHA512 810cd6d32990eb6b8f4012ecbe68902c5b5ecc29fc914f7fde700dc9c3e0ec8930d2438f56c6bed94ad7ff02e8203f1ce51705f2c331af0faba02295bd996dd4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 29a996cc8b0c868e21c0f2e08a206cda7e492c10c8f1501f1a5f12639038ec42
MD5 bdce64ab01f46bc5fbc97ab5757d9603
SHA1 eab6b700e2a9f3f053505003a7b253c305be0b12
SHA512 a96b6a3e42b623fe234b09ce20fac3968395b13e16af76de4c1563c5bd91a9e924f42ce57ef8e53ea298942a20cbe11b93a90a5269acd918e8c69a52a3754904
MD5 SHA1 SHA512

Submit Download

index.txt~RFe58076d.TMP

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58076d.TMP
Size 119B
SHA256 985909a6db93ded3bfdd1ac9e6128e1907df865951493776f44608a4eb281552
MD5 bb23b1c28e04e8e480f30908abfa5d74
SHA1 146d4d94fe91bf841330c4ff3716e44a52523796
SHA512 b7e53e34afc3126b7a3952b5d21576145094d35c63a3b5eb99eb083340788e0fa5b85c2af5923a5c0265d70124617f90cfcb72bc0f8ca2e0518eedf198c9d05f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Local State
Size 4KB
SHA256 753dddf838bdc820e4c3c7342dbdf1478c9b660529b48149dde4e20f4fec1ca5
MD5 bce77b1a92b9a2ab10923d3b6d4f2cbe
SHA1 7c5d49f920c3943d37f49f468f14878dbca03095
SHA512 9956799bf83a7d8dd2871b43316cd2ca46d5a44bb1a40514a65f226fd959e960bcc14b04d370c401e2709470922456f0820068cab63573b8d2a3bd005dca8536
SSDEEP 96:RqGNkCufRs1ZB58Frh/cInURoDotovlNDzBApvxzeFgJXUr/Bna:YGNbWs8ooDUwDtgeFQXSg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Local State
Size 3KB
SHA256 cd450bd3119bdbc87726b4fc8e8bed144cc810dddede97740db398e026e0ba80
MD5 05b6e24632153418f5e9c916d8dc5f98
SHA1 79df721a33cef05ba2dd8aa4b0e4753d87089070
SHA512 2a0c2e0f89ec2d8c27453700f61a1de46450489b014436b43885d1f2114161838405c48316df0d466b0a7efca274e89071063a61f1c291703ee8cde4b7ce4231
MD5 SHA1 SHA512

Submit Download

Local State~RFe57f7be.TMP

Path C:\Users\Admin\AppData\Local\Temp\fdftngio.qyi\Local State~RFe57f7be.TMP
Size 1KB
SHA256 1183f2408c11dfc7e9eec3a6ccd5c615aa616f822ba569383019afe266c0f4cf
MD5 e88c7c4e07710fde5d2f1fdc736d6acc
SHA1 b43900152dd551473a55ea5752deb816873d424a
SHA512 4a24affb3da8116f56a786c8da7e8ed43072ac42860d98ba35a49e204c5f8d77ee17aadc3cc033dedb3b2061c80cd638fa3dc9f9972f3c64cc2295c66eb64fa1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Crashpad\settings.dat
Size 280B
SHA256 5eeb27cc0347b22a87c78a53ee8c3e30980bf416d34b72775d21d2e14350097a
MD5 5d2cd7fbe06edc6b3ba9a2ad07b501ce
SHA1 a68ee80987977fec0e5aef1344fae931dcf4806d
SHA512 de87e316bdae7ecbe695eea7c900b8f27959bbe20426b3888d6bd6bc592dbb4e57fe9585a62a9db59919d5ff9f7a82e1b466ce0f536efe2ab97934e38e712a62
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Crashpad\settings.dat
Size 280B
SHA256 7370f63dee50d44fc54897de9a976f51fa251240706303ecd8856da6df696771
MD5 ad217d0cc97e9f054bec96538f551f3f
SHA1 f62bc6177e2c403a9af371f1aeab2e5ba229d1ed
SHA512 4461ccdce33c965fa6d020eb08937201676a7ad62169379aeb09024aa064fcda4aa46c45d016e4f8b259ff6839d9bf2c0ce58b094492c4f7c2c7db3c0bc125ab
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Default\Cache\Cache_Data\f_00000d
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Default\Cache\Cache_Data\f_00000e
Size 74KB
SHA256 7f676f82c934683511eadf35d3e1f4a8c3b78c9fb88f5f6893bbdcb573b21dff
MD5 d26baf80c387db15fb535968604be9a8
SHA1 5f238ffbd5c46f1016655f481679dc8a3e13804a
SHA512 b7c83ad18ed1fdb4c030bcf2c7e46c987a4a5d308ce140133d09e49e9c0b61e9d5580000c7c3372161d5a499d92e036266816655ad8a8e63c11c97e894321e52
SSDEEP 1536:N6TA7WUrE18cAeZzatg73ajfBQUKgvKHOKBSZmOChp2:vaH3AQX73ajfBDvKvqmO2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Default\Cache\Cache_Data\f_000010
Size 17KB
SHA256 875b5ce3dd35af59a423d06a9fb97dbd99a871bd4b3ce372a37331110011bdc0
MD5 e81abc69da48a9bee78a68e1adb94c9b
SHA1 8142284bf2d7d2e6ff566aff7a0fa3c90ed6b0c5
SHA512 185308fc7266fb1241c5482dbe45882f627fc3dda28af36363b2488eef1fc8903bcbece63de676e24a0ac10f0024602c1d0c706601e242af01fe8eaf3c044a3a
SSDEEP 384:KnRczo7MjPnsVdtpcVwnZcc31kEUugD+LHLf///odQ:KnGrnMpcVwZcO19UTKLL//odQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Default\Cache\Cache_Data\f_000022
Size 33KB
SHA256 cd75bc10f52a588a2854eeae979b370c6b461adc913a2066931b7988afad1dad
MD5 3a233d4387edc22e015d08793b27c51e
SHA1 38f29a5205517a673951a1c6884122822019c5a8
SHA512 e26c2b1a101322d7d15f8bb9adc9ae7ca2ff1f023605c5d0a93db1fd14d4465c439c59df6e5b033734d19067b22bdb8352dcc042403a35dabfc1d61bae3b9b0d
SSDEEP 768:Ou+yqTtzMQUNtJp+ZUQjwTHLTsZeBrrT0dmvj:N+1CzNVgZjgLTskDvj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Default\Network Action Predictor
Size 52KB
SHA256 2f80b3d97ed21bb40f2fb613ed996eb9735ce6993034397ccfecf1f37a1abe98
MD5 414d2be764f0ef6dda6a4d6485d06999
SHA1 b680a168a9c18abf2ead15f01c68242d125ad452
SHA512 c96459835a11700e1551e085a24f1bdb597abb7210ba93138b20ca6991aa0547146c08744677d35699a853d0e6c6f194a96ed33fd7cdd15ac05e59402beb1806
SSDEEP 48:T+dHYzydB+M9n+8dv/qALihje9kqy2WOT/9F:mHCydB+M9n+8d3qAuhjspFWOv
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 f6fe16309997ad4323ec5a68254dd29df5f888f911e307da57a0cc5a5669fe29
MD5 4f5fe9fc93c64d480c5711b7866628bd
SHA1 d3d2ba465210d65a68b5454322908d94ee8a17ec
SHA512 68b723952c65a55002f618604ed8aa520d1abfedfa8eaaa24c983b1971c4e52a83aa368a4958b927ad6d4c4bb2b74c2033b6b73da66b2db04b3c4d52effe0860
MD5 SHA1 SHA512

Submit Download

index.txt~RFe581dc4.TMP

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe581dc4.TMP
Size 119B
SHA256 63dcd66cfe24e9760cf1281efe21971d87c60219472c4b39ff48e3fded417ac2
MD5 e5c21da8a68d83f422c0d1b4784caa3b
SHA1 8f0aad13a968b6a4816661e1a4bc388c5ea8a8f6
SHA512 fb942980b65ea516dd5f696669ed1b52ade2b99a267f775fa48187aedade44f5b518b08870dee04ebffff1ef50efeea984e27261a079b37153511213e34cdba5
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Local State
Size 3KB
SHA256 5db0c6d921a4e08dfa4473e9e92cbaac982111dfc6984694d86b6472d7d86676
MD5 9dfd4421426e6df456b49816c217e670
SHA1 f628321432a3098a0ef19671cfcbbef35084bd75
SHA512 c61b6001c7de51bc4fe4e681f38fccc4fcc0a522d7cdbab45a0912334e878eb975645896ba2d46469289b181944a7da4cdf1e983492ec9e3e346836c4479b875
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Local State
Size 4KB
SHA256 c3d358a3b0431731528caa09e7e57c98fa4c9577b89e6e2b16b89ffa2ad9571a
MD5 71a73ca24bd5a3c94694e1a5b5e21424
SHA1 b22f670c6b696ec9f5d9714f2e6d9f2b8d3963f1
SHA512 c86cfc7268294d555ab7bf8b0f80fe4b153dc548c226f711c47cf60eecb8ac19fa17ecca2f6ea390e0acbfd404459620e208908a9184163e12299bad4dfdae92
SSDEEP 96:OqGNkCufRMo+iQWZKmY58Frh/cInURoDotovftDTB5Pv6fTLBgJXXzt5/LBVa:1GNbWjVdZ3ooDUwdNGLBQXDz/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe580d88.TMP

Path C:\Users\Admin\AppData\Local\Temp\mqdvicvo.nue\Local State~RFe580d88.TMP
Size 1KB
SHA256 c849c3556be2143e3b418a7ccd3587809f2fbc99cd028c9020839a073115d189
MD5 d572af88e85b53d5d14a66075abf02fe
SHA1 5e558e27081e764fbc4f5f9ac47e77a1239464b5
SHA512 bd1fc97d0b84ceeb7ab4655598869c94e2739f9678b5505e0f6755cc5091b47ebd32a77d48f8da404a49c4cac4a638fc10c5320d8d25aef6e00ca5cc1f70be72
MD5 SHA1 SHA512

Submit Download

303495cd-47aa-4085-a5c4-ff8e5b3601a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2484_647120797\303495cd-47aa-4085-a5c4-ff8e5b3601a0.tmp
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 68e6a3d23bd43d83b4a0a3c5575a6a8c7dd21506ee7ed01013123116c91a0490
MD5 81e9d54880e9b8efa4915a143b93dc94
SHA1 70a2747134015384f1d0fab106be3343415bc1ee
SHA512 b472a7620beaf0a62c2425c99d0154c910d8d8c54516c76eab4c8cbc934afb6f978479301215fea5f2a61f7f782c6b0931c57b2c31bf12108e679dac045981b6
MD5 SHA1 SHA512

Submit Download

9TGURD1D0SEONU24GJDD.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9TGURD1D0SEONU24GJDD.temp
Size 4KB
SHA256 24c751df219a9740d708c738c8fa91d1600d78c1aa1379f60a79856865b330ae
MD5 349668ea52b3ee69412873ce932d9dd3
SHA1 deee75555e94a8965ccd1209012e3f14ad970178
SHA512 3d8bd915255efabd40ca85b0a8d75270c2ffe96742632121c10d069eba4829482d45d5ec176a08eb8645c69ad4bb619b6d9700589cf3d3cc2a241e0bdf10dee1
SSDEEP 48:Wx5dOs1L9zqJ9zUoYsDVdLXuHp9plx5dOs1L9zqJ9zvYsDAgdLXuHps25:JJUo17uJ90Jv1AIuJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

48661061-c45f-4e03-9cfb-212d6ea32b08.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\48661061-c45f-4e03-9cfb-212d6ea32b08.dmp
Size 65KB
SHA256 db900cb067dc2d5bac3d0e47d30384277a23e3aa15582689178d2ea48014b420
MD5 f2fc32b182b801a75fcae443c356a213
SHA1 acdc5dc377a3805e19057c6171a4e985b7334f28
SHA512 5518cf9a7dfa1074174f58d665edd19155ec1607c5f826991f551ad74437b640e3b62ff20ce5022a4daa5217ccc31ed2ad5a950699b170c4ddfb3ff81f6ead74
SSDEEP 384:9nO2/Fx8ZTDYKSDB+TKRr4dt/3tNa0dtdXlafB/fQu96G0WCa:9T/o1DYHDB+maHHU5Hh
MD5 SHA1 SHA512 SSDEEP

Submit Download

48661061-c45f-4e03-9cfb-212d6ea32b08.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\48661061-c45f-4e03-9cfb-212d6ea32b08.extra
Size 1KB
SHA256 60b6427312d71e7d22024f7509cbfd293171528f777f7ed64cc519780ebf6fea
MD5 fffd55f44c9703dc54295e21bcb7ac4c
SHA1 a0089fd05a4b08edc1dc43b1e5af058e3b91fa86
SHA512 505ca93a96c68ef8f811e53046b99cb4219e70e1b65fdc98a1fc3e0035421ed9d9456b4545de10be63a177940005f867c81a9b2379c5cd47ec491d4d7a3cdb97
MD5 SHA1 SHA512

Submit Download

48661061-c45f-4e03-9cfb-212d6ea32b08.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\48661061-c45f-4e03-9cfb-212d6ea32b08.extra
Size 3KB
SHA256 75e22d2a0dce33e5a19532bd199a4c83a7f27b914602793a3ce75101d6866895
MD5 59114dd2d270b5120d91e0f214506bba
SHA1 6842fc2aac53538b4ee13907cec2033bb01186a9
SHA512 a866a4817d156486c79081b73aac7e636b0669220ab05ed9d1c55fcec217cadcc8ea367f90e982f44a54cb8a81e833053158e7b3136ec47b34a6f5fe50450a5f
MD5 SHA1 SHA512

Submit Download

71dafb6d-2843-48c4-8b8e-c1410fd59683.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71dafb6d-2843-48c4-8b8e-c1410fd59683.dmp
Size 66KB
SHA256 f43305a1b99ca64e58629187c5e08e545a635f19c46529742cdcd49afa6f022e
MD5 f53a7309ace4fe315d2dadfe8df28015
SHA1 bdeabef9680fa81a885798b4300d5c72cda41fac
SHA512 f8b5f983e9365bdf51cc69bb06e5a02c50ad9844fc4c1929dd9021e975d20aca75fd76d5094a674db86917ce440e48fc9ab2c5d7d567daf3d3017658cb76226e
SSDEEP 384:CdOPEOwOH5OXqvxWvuCCKrFhfLaC4dYfQu96G0WCa:CGEOwOZOEUaKRhfAYfh
MD5 SHA1 SHA512 SSDEEP

Submit Download

71dafb6d-2843-48c4-8b8e-c1410fd59683.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71dafb6d-2843-48c4-8b8e-c1410fd59683.extra
Size 10KB
SHA256 b71b1b5b2ca5d3745c8b8fd7020e530cd4a2ae7f73bfd0950e73c8f3d3b3eb9b
MD5 2a0386268fe84d65219fa9542b8d6ffc
SHA1 9eaf10ff09b96b47828f6d5fe743c8d86c023e66
SHA512 e1953598535ac480b8dffba91b16ddc58b3c497021457b34fdeaebeee65687145f1880a0b90d7195439b8a686234385ee6c4143caa896dcd0be036a408141812
SSDEEP 96:STWCOl6TZDY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7ajutILfcBCqn:S5OlqNYb/7uvZ8PL7xsP5wlvRfoR
MD5 SHA1 SHA512 SSDEEP

Submit Download

71dafb6d-2843-48c4-8b8e-c1410fd59683.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\71dafb6d-2843-48c4-8b8e-c1410fd59683.extra
Size 10KB
SHA256 9259772ef61d50599abc49781f5c7fd3f67820aaf198939c80345e140e0ec27f
MD5 989f1c34df5f6ea47b24fe5f835429a3
SHA1 69628a02ac073b6c12cef977ebfee59cd1916de8
SHA512 0e4576d5177db753664d1a7437a007c50449878c66398050f0ae8374731abe41cb3d520d6607d6da46dd415b8b7ac1b06d9b4d05a26d256c280d6e26c17730b7
SSDEEP 192:S5Ol4cFQiR4M4DnQYapdVxzPhWBHF4T/fKNtalXRfodbLgOD:iOScFQiUDI1JWBHF4TmafAdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9ef5c6f-3552-4d57-b5c0-c8445798aa66.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9ef5c6f-3552-4d57-b5c0-c8445798aa66.dmp
Size 64KB
SHA256 daaa655fce1e88c9a2648c611563301037cc7ac8e04bb834e571e98c9c6d500a
MD5 ad44ab4d217de6675e83a60dd21ab85f
SHA1 181b4538ff8ccf04cd4935f63b7f364ef516283f
SHA512 e85f8070cf8b0501feefac84bea036cf6ac2de05202f536709debda1fdedb18145739eeacf7fcb18da5f93cac1c56fa986598c4aebcc2721c77ca7793e7455dc
SSDEEP 768:8ofoE8LA/Fd13vkdJvgkqnJuCfE83cmGSh:RfV8LA/nNviJvgkqnsmGSh
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9ef5c6f-3552-4d57-b5c0-c8445798aa66.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9ef5c6f-3552-4d57-b5c0-c8445798aa66.extra
Size 10KB
SHA256 1c3a36793c689cb003a1a1d6cb77fb9352932d054178b13f5e94b913459dbba2
MD5 63f6c1b1ff4cc5e4e98693ac9081ca9e
SHA1 32724af7c702a8d81d7476db825b3ccccdc765f2
SHA512 950c730b86f0b8f18aaeffe1700711d91b3d1eca87bebad9e79cd9ebd81fc8f53f47f8405cb399e1163e02a9d3a910cb61a6b95a297cf18878be899e09bb2f4e
SSDEEP 96:STWCXTZDY6pw6lF29dt40Rh7CTvBb1d0DjMLlIrLlhTLlaXv7atutILfcBCqwvEQ:S5jNYb/7WvZ8PLFxsP5wldDfoQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9ef5c6f-3552-4d57-b5c0-c8445798aa66.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9ef5c6f-3552-4d57-b5c0-c8445798aa66.extra
Size 10KB
SHA256 1e34230e758ad003c8a4b472a0cabc02ddd67dd496e81bb33ce06981b76d43a7
MD5 68bcd773b608a34b82c11edc357a1df7
SHA1 4936c47106f9d2b22c6aa06afa5ee3d50e0ea220
SHA512 3375e924ff4bbaec1c1b89878c5c159f640799f604f872e5d580788980ee99fe85a88cbebb317e5fc13929e026f18b2e9165eeb53556de0a3c409ae98837d30e
SSDEEP 192:S5/cFQiR4M4DnQYaVdVxzPhWBH94T/fKNtallDfoQbLgOD:i/cFQiUDW1JWBH94Tma3AQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

ec9e35b6-a1fb-4bbb-b56d-6d933d8738d8.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec9e35b6-a1fb-4bbb-b56d-6d933d8738d8.dmp
Size 63KB
SHA256 9fe22165b99601f353b6d03b5c3ec18f0be7d77ae6b8c812050038ea1da745ce
MD5 03cfd4b9279c24c753fe94ade207b2e7
SHA1 81b0dcf14f4071fd881a5dbbc4c58ae1b6f64b90
SHA512 7efdc4e98f0309d75a450798b4a7fe62e211b1ca80703b8bcfd2a5250303cc60d0dc55115a4e358d4f77ecdae66cada8b25115b4f0212105ab6e7d17ad53125c
SSDEEP 768:HtvQjqy4/HY44J8ZsvbYYSF3U57c2Gdh:mjtL44CsvbYYSF3o7c2Gdh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ec9e35b6-a1fb-4bbb-b56d-6d933d8738d8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec9e35b6-a1fb-4bbb-b56d-6d933d8738d8.extra
Size 10KB
SHA256 c54593a35d877f7374b2c01e16299ce05b21faaae90f4d9ccb5760b59a9833d3
MD5 2bdaf48773b168bfb83e77b101f1de8e
SHA1 9db533520a856518ab8f0d1ae77bb3ffb9749d09
SHA512 569889ac238e0080065db3d8f6fe95c739f88c5f169e6f65de23f02068daab71d3f30e52c9caa3be244193b9c37172b65750c1f49999d54cb35474cd437000fc
SSDEEP 96:STWCJTZDY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aVutILfcBCqwvN:S55NYb/7uvZ8PL9xsP5wlw5foxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ec9e35b6-a1fb-4bbb-b56d-6d933d8738d8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ec9e35b6-a1fb-4bbb-b56d-6d933d8738d8.extra
Size 10KB
SHA256 fe4d45b4be1cd14039d9d897105f9e135386329dac87dc978393400837cdd588
MD5 cd3a54f27cab5526ecb4161061a75f9b
SHA1 1a2279a49357af04376bbd7a79750bc755f7d553
SHA512 e1247b92d39152c30db54a1621dd1c6e7d759a8ec60208a3e1ec8bb08ef077862363c04800899c916d595808f8e5092cda5e7195bd9482fdc7497f1d61cabf41
SSDEEP 192:S5RcFQiR4M4DnQYapdVxzPhWBHh4T/fKNtalI5fox9bLgOD:iRcFQiUDI1JWBHh4TmaKAnR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f0133374-b1bf-4c9d-92bb-928c69b4211e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0133374-b1bf-4c9d-92bb-928c69b4211e.dmp
Size 65KB
SHA256 69f2c24425f9166b33295276a21499dcaf5acd280e9bfcbe3d35edfe43d42761
MD5 11ea40b9259857d8ca2d10a8b611077f
SHA1 a325ab07417eb393beabc83e938049abd5e16eb2
SHA512 3fe875ea09bf9d09c9fa1dd865c61131477108e8228621541eb1ae40b80268fc43f37183f52c2733404a6d22c783ccb242b643723feee4afffd2f9b8b665fceb
SSDEEP 384:/dOwcCRo704EktYJOHG1Dyvi07GlQu96G0WCa:/tfRozSOm1DjuGlh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f0133374-b1bf-4c9d-92bb-928c69b4211e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0133374-b1bf-4c9d-92bb-928c69b4211e.extra
Size 10KB
SHA256 06d075b0ed79f5a81fd74973cdd59253662f18c0aaa18a3b3f2be40a85d3fd3b
MD5 285476ee2c9c3b276dbedd25c3e02568
SHA1 237f2c07d9db5d811b8ea2af3a4b540bbcd3a4a4
SHA512 a4aa9c60d997ad1fa6182a9b3a401ec8512dae0069cbb3fd03203a93efd3b05e3007b5caf93b838b4583c317c3e84a0b307e1fae81f904b158334f1636c6afa0
SSDEEP 96:STWCJTZDY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aRutILfcBCqwvl:S55NYb/7uvZ8PLRxsP5wlJGfob
MD5 SHA1 SHA512 SSDEEP

Submit Download

f0133374-b1bf-4c9d-92bb-928c69b4211e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f0133374-b1bf-4c9d-92bb-928c69b4211e.extra
Size 10KB
SHA256 a70f61c4deda5217b49fa7cc57b8f89bbed1984af101608ba4dc625f94b0857b
MD5 6eee6bbdf0dd07d78b8fa8ccef6cac82
SHA1 c5cf29211413d14abaadc3de9ed564063d898f13
SHA512 1de64669695b6ce080d24837bc6f4d232a33a6556b830cb3ffb300f86be0bb7a319f61ee260cf279fe926e8a8ae041b5570453d4a33f72e2419275563b4a7d49
SSDEEP 192:S5RcFQiR4M4DnQYapdVxzPhWBHV4T/fKNtalBGfoXbLgOD:iRcFQiUDI1JWBHV4TmamAXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 3ed25b6421f40b3b22c0ead02587a6100aa93ffe4b677bb0332658f500e95465
MD5 c1e372fdde3805f91069c78574e1c6f4
SHA1 0335b1409ea2e1f8f1b2b81a6b1409d932b60041
SHA512 ddaed7420c0c4347e68fff4e35f504068a4efba84f1d5c0491673a1b371edd01d2ef12252791947e4ecb07faaf51c99ad02c7545d7e4d247398fafdfb351dd94
SSDEEP 192:2uLnUjPpb3aA+Dlpl0kOY1IYKS0sKY1g4rRJK+mIw3d31:xTUjPFKdOYVTmJV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d9b16c1016620548a0b52c0665d240dc8b2575efe1d7333fd3a18c8e323321d1
MD5 e3c6109d904af128977f093d9f330906
SHA1 1507800eefcfc508f3bcf0a2f414c644c8fd89d2
SHA512 407e01ab907b95bc2fc5b2a02b7fe23333440e9b72a72b4d703361d67fc63fb0c47db0431b21b4e4f7370d3d8d7d7d1964ee64045a259c71122204b941b4fa46
SSDEEP 192:lRn41/66Joz0dzgCl6mSSdDfVf7Ov5zboHiZffCyOyjKfdWJ:vS/66JozQzgC1bVfVfkboCZffBOyjKfm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 336e458189eb4892837e6ae104dbe16f26f85fa669478baeaab7d87e33888fee
MD5 9ed386d020b97a684507165b31473981
SHA1 bf752a7a0edb54421c2b9e2e02716c3c8ab25d08
SHA512 b64bd976fb9443617345fc2aefaa16d4df36fffb8bd04c6e67f6a61a93a543d1a44f1b2fc2ba3581c85925dec501d28668f8e8ae403bc228429b37ff8b27b036
SSDEEP 192:CfVf7Ov5zboHiZffCyOyjKfdW0Rp41/66Joz0dzgCl6mSSdz:CfVfkboCZffBOyjKfT4/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1867110be01f9531063d02f17ccc50e799842d23dc5b94fc0def55caf1019392
MD5 87b3c6e4a742e474cf69107866955597
SHA1 f64edd4cf24e4aa77e7ac756179220dfc41faae6
SHA512 b887dc6548e8f51afe66f6e0512735202261ffe9ee2e648aafb3730f29191a54343014e913d55153d1acda9295548c4d87ed20478718124af711beed98f6180b
SSDEEP 192:GjW41/66Joz0dzgCl6mSSdkfVf7Ov5zboHDbffCyOyjKfNWJ:8L/66JozQzgC1befVfkbojbffBOyjKfW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f60090736ea43fa98a5c656f248569d81f4db3d70916c517a90533556ce6671a
MD5 01631341582d2f4487172751743f55ac
SHA1 cd2eb43457a37e5215b350ef04d3a841921b8a89
SHA512 534ff452b0a9327b23280a508c91010385074581ff3ffd6cf9a1f571c1fa807517b2cd637397ab59a6dcd7b88c65e0c8c3aeec569095a0d09d5d33bbeb1f5b23
SSDEEP 192:/m41/66Joz0dzgCl6mSSdLfVf7Ov5zbo+bffCyOyjKfTI:j/66JozQzgC1bNfVfkbo+bffBOyjKfs
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 795d4ba4cc4333bd49c3b41fe2d819ca5ef30afbb38af798ab1d66bf62dc8b62
MD5 ed5079a115bdfdf281f0950c1bafdbc5
SHA1 49efc7bbbec2325ac2fcbae05dfdc2e0d0402554
SHA512 c54ecae39a71a5fa72be4d06ccd258f11e3fd32bcee7aa3694d53e9849b94d58667a2cc31a1543d6a8de3f4309bb1725f0f731cd0b6133dc1663b47f46e2ec4f
SSDEEP 192:CfVf7Ov5zboHDZffCyOyjKfdW0jj41/66Joz0dzgCl6mSSdz:CfVfkbojZffBOyjKfZ2/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9ae424b829f4c3de3b25285154641b017a0cb6d22d409e71425a8c8c190aa1a8
MD5 39c0a744c39fea4bb2a9b3b224f72de6
SHA1 5bf775533fc806c0ca9fdc469b753c6b633c0821
SHA512 c76c6d6f3b4a0fd0d33313bffaf8f7a8a0a0db74e29d430723e1ae554d7323daf71d9af4274dcce54b0fd59ee966c2a0a972b10b66314bbd72e930fee886be4b
SSDEEP 192:vfVf7Ov5zbozbffCyOyjKfdW0Rp41/66Joz0dzgCl6mSSd:vfVfkbozbffBOyjKfT4/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 df0b7bb96d3b92eec2f1e2e8c87e884db2a414be4eb83e330ed8d4aed2ac740a
MD5 29ab16e70e6ef5406e27a6145a493042
SHA1 ac3831ad4087180e3ebb22dc337f47b01b6beb1d
SHA512 f8b39cf395e2c6303acc871c6f7f3e3b719440bbfd2cd10f6c81511fd050549dae4b07d26e750ae92ae4ad49705f4083952c2f763db757dd313384ea4ec0e0e5
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 844dd035a41b932ee93e005f89cbfe0ac6b38a974289dd136bcd14f03d232092
MD5 3bd8564f856d63595b49e50e18885809
SHA1 4fd70b01f86e283d1872c72cc6169479f39cdcc0
SHA512 1aecd8c0cec99f2a7602cb2378a42760ef407c74843580e9c4fbbebd29495701b7a8835c133e121f27e17203464e51bcb09c66b1adaa2a870616cb7aa3bc9d5b
MD5 SHA1 SHA512

Submit Download

0124867a-a93a-478b-a0ee-4a17bf06d56d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\0124867a-a93a-478b-a0ee-4a17bf06d56d
Size 235B
SHA256 1583777d59e505fd62528afedb654f8c39325c6df3fd3013ae5e3609ec06df12
MD5 9a1bbb849e0b036c88ec1ec7243c54fc
SHA1 a60f0491394d33624daf3a0d97b67e16268c29cc
SHA512 f1f76a670e2df93c86b5b5d2646e49b2f6f7463a2effb87bd8f45fec2cc36629806e1057e9700450f79487c210afeec48f3cb77001e7d5699dfec7cea0567ef9
MD5 SHA1 SHA512

Submit Download

0350c805-45c9-483b-a11e-66e67fc435a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\0350c805-45c9-483b-a11e-66e67fc435a7
Size 16KB
SHA256 94e4ef7a9635e1d2492987b75382ec6c728d43215ede316f27514f242d7dbe02
MD5 b5d1a14b709594be3b76b1cc38ad65a6
SHA1 2f666815e822d1fceef96d5a480536da11996430
SHA512 082220956b40d6c68db9b0a205176fec2531531248e8d498c8fb2e290a5b468f1fe9062c3fbf36051a9bcbfa9f9f6a679951b0903084324e665c963a15663761
SSDEEP 192:UT2jLcbAxU0oYbqHtnxjyyYzcubo1QabLupVIEBVbKG5VrMQlK0fC/Ehr0Rzx78z:KJbUjlKwVrpbaI0Rl7YytR0khKb
MD5 SHA1 SHA512 SSDEEP

Submit Download

0d0befb1-b002-429d-8819-734837eb04c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\0d0befb1-b002-429d-8819-734837eb04c1
Size 2KB
SHA256 d1aa2e18e4c70500ca03d8147a8ddebadbcdd373bb78943c2b73e29286cf212c
MD5 446e3c96a8962d98c661e8688b1d7658
SHA1 bfdd9a4f517ef9b5d0406f500d1076db687d5a23
SHA512 8bc5676cdcc7efd6c74ef9cdb6e07840f12c833cc57453c22a1dcbd5efacaaf76c851c83f86bdf38c9f3f4d2eefa761441f5e341d3dde1f5f63286fa73f4d19c
MD5 SHA1 SHA512

Submit Download

130f30e1-6669-4998-874a-5a4a0c2d07cb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\130f30e1-6669-4998-874a-5a4a0c2d07cb
Size 3KB
SHA256 a040256dfc613260319a00b089f0a71340c6a0c76e3b53049399fd26fca5ab4f
MD5 7929f148f0e22590dcff348b51442d62
SHA1 256c6866d6eba70c9eedfe3aa87a905d732abfac
SHA512 4cfc8e527940dcc2f0e9f5348f7e3c93c263eb88c4529dfb419e86a6a1cf544c83d27ab0c6416e1192918c563bde47e035d7765c9115c9dbe9d98a0e739c6c58
MD5 SHA1 SHA512

Submit Download

221b4f3e-b35b-47d1-9fbd-7182f123c334

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\221b4f3e-b35b-47d1-9fbd-7182f123c334
Size 2KB
SHA256 013c57e69ec6264791da6074aab9ee0b9d36b38a6d7e9a99df62249e6aed13a8
MD5 303e89eb23db552d2d329a35a4c40fe1
SHA1 1614c64b4d92f69070fd47fc7d92ed80973f0a11
SHA512 6dc21fc79144c6d93d557d7117bf391e07018d5e65505182f31e769189c9d77399826b45cb0888e0a4ada143e991477f8e8d6e2f95ec38c0e5e866be1dc3ef0f
MD5 SHA1 SHA512

Submit Download

238eb374-96be-4c1d-a38c-e30a6901640a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\238eb374-96be-4c1d-a38c-e30a6901640a
Size 235B
SHA256 62c4bc0e9b8ff1099d8b5623cbb6e87a3cca8782b8031bffb5c85fbccaf356b3
MD5 b800de121a7e7872621a7ac30671dfc8
SHA1 dce0c500ffcfb7299d85b70b24834c4aadb188bf
SHA512 34d3fc4d68d84ae7185920bd2041bbbcb55542a25e8ab05fd08fc2735e517a7324cd18727f362b6ccac483446c1de1fafc5e5026c2c827a8101e9e824367545e
MD5 SHA1 SHA512

Submit Download

23a6d9e7-9942-4078-8624-b46ae0602e23

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\23a6d9e7-9942-4078-8624-b46ae0602e23
Size 871B
SHA256 708cd7ed1edfebd75a2b5e182275da792ad526c91bcf15c7625cc5b5b51688e9
MD5 ff6b7fcb8fdfe45a981a590021de0622
SHA1 706a8342f0e02d77203c17bfd5e5c4ef07c9ad15
SHA512 f95c723e8a116ffe9e29ee0bfc9e4c855ddbca1b17766b09e9d180e7c9c623c0a82cb06f2649d3d750b0d4bdd5df1ea2cb1cc36f72814ef4bd1d791323bc6486
MD5 SHA1 SHA512

Submit Download

259ba7ef-e160-4c5f-b2fb-07671cc8e896

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\259ba7ef-e160-4c5f-b2fb-07671cc8e896
Size 3KB
SHA256 e7ed6cff1255a0d04b7665811ad66e845b2b3b8c45f290758442e7caa0f02c36
MD5 652baab876b27af6504a99ef45d9c48a
SHA1 0650ef899a95dfadc777087a565b63dbb47b6fca
SHA512 093874150fe54ccd76a390a7c17cbaba45681fd7d6beceeb6063e534bbb02c734e5ff20be0665c48d0069261530291a87a1986e4b948721077086cf9f3e380a6
MD5 SHA1 SHA512

Submit Download

39937a16-e273-47a5-8c05-b2693066d883

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\39937a16-e273-47a5-8c05-b2693066d883
Size 886B
SHA256 b603c486592e5e1f5253f0045d6fecf73b7b27b04e4a3d285577a7f4f700f4e1
MD5 e5c95b0e9b15365554e3f583131af94a
SHA1 cdea75b59663b926e292c9ba6fb7777c13dd2af5
SHA512 32ff329d85b41ce46fb0b6677ec83500fe9f2572a4384597fdd2d0e8f1e7ab2ba5e462ef401041ae04a03b8d3570c3ae212ef3ea19ad637174c42aec62897207
MD5 SHA1 SHA512

Submit Download

4ad36f31-e4ce-4e2a-ae76-dabf11fa88e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\4ad36f31-e4ce-4e2a-ae76-dabf11fa88e3
Size 235B
SHA256 b559f9ca64b8503a2c4efaf2adfd9f25c34c76840f0781901a21325302281dac
MD5 af758d4b73543d55c3ccf46c85e367f9
SHA1 52102d6041bc40410e747c863b2b6bf4d8d2718c
SHA512 f500b2b6c51917af1f138381a5ab2791cbc84b2ee13f50fa7c20e76ac34eeaa6843b79e6266afafba8ad09475b813e5b2ccf614bb4d3a5391c0449ee5536e71e
MD5 SHA1 SHA512

Submit Download

53d7e0f6-c535-4acb-9686-87361c0bb210

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\53d7e0f6-c535-4acb-9686-87361c0bb210
Size 883B
SHA256 a2f4666b70cc1f5369ae77de6d3fdc3edafb2e8abc0e7e246ae5df06e6a97f17
MD5 d5d06c617ac0057d6b9c05ef18ba9c2e
SHA1 3d3ec8b972ee0ff7b726eaba55d4748a22ab0c34
SHA512 167f131f0ec089778969d5a365701eafd618d1377be7e92d1b07240977b02cb40c16f8537442d9057b1dd3e333f7e7031910f831894ab9057e60ded511e3b209
MD5 SHA1 SHA512

Submit Download

6227bb22-2465-49f4-9585-86d26a28e311

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\6227bb22-2465-49f4-9585-86d26a28e311
Size 3KB
SHA256 fc05fce7050a72efa93277c1a9d8b559cb5f091954613834c291be00e7fff444
MD5 0b9b5b52b671fdb811396145fc4de19a
SHA1 99cb93cc0c8f57d9150be409f92778390e0ee6ca
SHA512 6c9c7b60b6636f0f22cb94cab461eef017464555982cc3398ea5ae31f98f753e848aa2681297fb6f5a88c5c5c45a10915fabd8c5784c204eeb751fba2b993ab2
MD5 SHA1 SHA512

Submit Download

6d626923-9a8f-4430-b2e0-e32611a77ed2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\6d626923-9a8f-4430-b2e0-e32611a77ed2
Size 3KB
SHA256 1f390fc6a82ea6ba139b2d70dca976ae62da6c3c9f1c7ad26b3eeffbd75f4689
MD5 a8623dd40cc06fd77d5df892ac41f6cc
SHA1 a1f920a91b4df27b20d838a8ed1fc432bdd11f8b
SHA512 36c879c6acd07596271e13cbcd8d9d58fe639cb8722be4e14c459102fecd764c99f1b5f140dcef2abff124ca3db318b7eb5ee44760cbac4c17dbb22d3c3b8a5f
MD5 SHA1 SHA512

Submit Download

815e91e3-bb71-4d53-9855-4390c23030e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\815e91e3-bb71-4d53-9855-4390c23030e2
Size 3KB
SHA256 1eea6f3e1b383b441880dd91abc01804fdc9bcf724612f4d4f7eb15aeb7380f0
MD5 2a84e7f414e86f115c31079db55eb2ed
SHA1 1f504d6ad334909da8c6db444fd73c46ced66b93
SHA512 2ec28a8b77d3357e5f98d84381163173b75988f712b33937d78e15d5cdddd8512616397a2c0b2031047e0eb2edf3dc476d054002ddff5e4b16a8468020c21d5b
MD5 SHA1 SHA512

Submit Download

b5ee0969-aa12-4970-83fb-099b473268d1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\b5ee0969-aa12-4970-83fb-099b473268d1
Size 3KB
SHA256 5240816265d2579d24161edb90731420b18b6522457fed65496f66bb91322e4b
MD5 a11a3a3aa969fb868c0f394841675613
SHA1 f7aaa3bc9b1a3f1ade6575dc20108803baba2f39
SHA512 c89e112b030c9b2855059f3402388a882a618039edd6861df3c7507025eb07c76e3f68879034307425631f05394edfdd0c1aef5947d3098e0691dd855d17baa4
MD5 SHA1 SHA512

Submit Download

bd2b211d-7004-4c46-a9bd-695572950cee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\bd2b211d-7004-4c46-a9bd-695572950cee
Size 3KB
SHA256 0235084386559f501bcadfd66d9dc1754be8fe1bc826145d69088d07f970585e
MD5 f711056c7fbc9e82abe98efcc2fb2922
SHA1 7009d224433fd2b20c9a5b354a48073477c5334a
SHA512 ea4f7a96f4ed18c6e4436807057b7ed8336198f477720acf9ca9a70299cc30a377953bd966780d2886c4024a9ed90d66c43d020f80c6111e44704686b7f4cb7f
MD5 SHA1 SHA512

Submit Download

bf182ec7-cf4d-4bc9-97c4-bcfab69b3fc5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\bf182ec7-cf4d-4bc9-97c4-bcfab69b3fc5
Size 3KB
SHA256 ad56981796f7a677fb14498c3439c4be274e298f1b30ea2676c05e474a7eb365
MD5 ac0e62801130aa56d2932d3da0d13308
SHA1 fdca2191f842e4dfa3b28d62ce0aef3b11cdd596
SHA512 d55bf86bc97e7af2e86d79be5c7fc0171b620f81b021f0db15cb08ab8d9f5b453d1a40c1e618244655f9a2c0e9c82e8e4f80c295054a74929baa94abaa0e1eb5
MD5 SHA1 SHA512

Submit Download

d8cc2567-9f6a-4419-8cfc-fbc00c3ca53d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\d8cc2567-9f6a-4419-8cfc-fbc00c3ca53d
Size 886B
SHA256 8f1139e4f88a1f0b925fea014323fb6258868cc61ff6f2d14a62384e11a13c43
MD5 64c0e368138847107e4ce05d72bb85d9
SHA1 07631cb9f24515c50d9284fdf226de6acfab1931
SHA512 f5f89e6fdbb465625ec40f2fa96abb3dc9725c63ec6f9bf3afdcad080f741a85af3ba4c350713b14435aa31847544390d2020ed148f5c380f59d7c4f16dc3f8b
MD5 SHA1 SHA512

Submit Download

dfb2cc94-f01e-4b6a-8532-39ebe7757ff9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\dfb2cc94-f01e-4b6a-8532-39ebe7757ff9
Size 3KB
SHA256 9a9ec2be2a0679ddd0a1de9b9d742c0e9bad5ce1234b6e6a5f9036733df0bf30
MD5 6dfda1d09cbd0f7345960b7fa5708f33
SHA1 b933672e0b8b567a5b60490789d720e532ed6d2c
SHA512 de745b8524773caea0f318ab7d01639f3015727e9748b5fd4352bc4541e63cc52291729aa02278f335e2823281c68e6df1d65cac8d097ac0d695f24da71ca4cf
MD5 SHA1 SHA512

Submit Download

f79372d4-f709-42b7-96dd-d70487657d17

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\f79372d4-f709-42b7-96dd-d70487657d17
Size 235B
SHA256 9bb03df52f7dff4bb74379eb5890db398e0f8a0ac99c88a80ec43c2269f36349
MD5 d9c23a66cc26af5f90aa15975b66a4d3
SHA1 79ffe95eded9fbbb4ce2bd9d2550491df7a7202c
SHA512 986f8d5ad0b890f747a4f31f54bf8795389eea29dd0e0098baea12bc0a8ee255a56960be1efe368fd53f0a4749c1bef4329694b388e585846c3a51a33f5356c7
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs-1.js
Size 6KB
SHA256 331198b084f0b6cf20fbea28a1eebc5fc8c74f37b98debe9e37e66ca46ee6eea
MD5 e25d66f994d01e4fdeb896e7145e5af2
SHA1 4733fa01f3996477a4fdb2fabc137000f71f82d0
SHA512 eaaf69374e7242a0437c5c7e20f7ff40de743c7dfa263c6a86c3981a6117387271b1ba2448e493903e160eaaf7f7bb63d829b6b2a23dd9b784473b164d0d0239
SSDEEP 96:xHpUTUJqGqXfKK5no1zSmSSlhdv9j5gnivH9NEBw88H8L4cnZDRtW:vkRXfKaobSSx/EBw88sw
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs-1.js
Size 6KB
SHA256 e4c0a997e0980561b91a96df22acc71d9b2de767de8f42a22966ee2218fa767b
MD5 c81d1b5f87100e6f5eebe4148fe0eb37
SHA1 b4d50cc2376bee5708a59d017e87f8ab2c3bd869
SHA512 f6a5a3b193f6f169fbd184bfc75e5b1a51d19f381a4e4288b11b15fafacc7c9577dcdea524d8831dd3fc20db318bf5ddef7bbdd7e9fed7752077ee0af750360b
SSDEEP 96:xHpUTUJqGqXfKK5no1zSrSSlhdv9jbnivH9NEBw88H8L4cnZDRtW:vkRXfKaoySSC/EBw88sw
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs.js
Size 6KB
SHA256 54a581877510782ec2e3a5f770c4525a4ca220ff923270c2adf213d7cf646e4f
MD5 e708cd43b4b807eb05e78053edc7e5ad
SHA1 3c5c49e4030d687bd83791d6bd871e99b6e99784
SHA512 f8f3092c23d3bb5e2ec44dde0e5f68d5a6ca131976927818089f24e25931491b63afe1a4610885d15a29c82fb6742e3c094b3915580a0235cab79a83ce3ea655
SSDEEP 96:xHpUTUJqGqXfKKwn71zS25SSlhdv9jAnivH9NEBw88H8L4cnZctW:vkRXfKL7X5SS7/EBw883w
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 b0aa297aa98a51e23fdb57b6c14f6e99822f7d782709b4aafd14058a25c8554a
MD5 78e2c7d4a14bfccc67ab76cc5de69abc
SHA1 7fff81ba644135a71f185e887a4c4b0dd2003649
SHA512 7798a2a007ce5dae62f3ac804612ba37152c7ba54c0529c96096b9dfcb980e961485feefd75a41ee270d75c25e118837ac4d0e1540049cbd27c4c6bac74f0d2b
SSDEEP 12288:Is51nEv02cirKEbfkyQBFffbUSHPESwAQK0HyACKu8l8gMy1KJttGhF0:I+10i1ysFfpPKR7CKu8l8By1oIh
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 10c73c0c440d9aec61e479047157ca3437249a9b3f1e91e0ed83d462a8599902
MD5 f124d6cc2d8ca6ae6e6dd7021cc72057
SHA1 9ea480542443ae78f5f100e44eb29dc15b9ed498
SHA512 f3f1f1821eaac3f71fda213d2617cc29b2c2f9a6bf89c051c116ecefbb83d3b1fee75a7b28d25b60828d1105b3dd1b52c45be34eccd0a039a5f400cd72a6d124
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 371721980175322ad753a3deddef549070eeda8b390b5b91e981571bd42c4c40
MD5 25e63f049dca0bbd7c6e73b56c516d9b
SHA1 36e6087b4fbcf53fd8dabe1c4156d438841dd817
SHA512 8aeb6155946972097b6a93238badfe7874b1b5fb7358791d8555c0d913b6ae441f04cce277ef0a99333fb6352c5c1856196d1f7c6e27550ff29739557430dc80
SSDEEP 96:uhgTlHp4WWphph2NwK3BIK3L8P8i3sMwK2XK2QlajztArcN65UwK3AHK36:iiHOWWphph2i6IWtqs7xql6xGcE5jnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2484-50-0x0000021EDC270000-0x0000021EDC27E000-memory.dmp

Download

memory/3332-186-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-193-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-192-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-191-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-188-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-194-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-198-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-199-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-200-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-201-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-204-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-205-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-209-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-210-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-265-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-266-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-267-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-269-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-268-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-264-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-211-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-212-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-217-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-218-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-227-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-230-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-231-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-232-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-233-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-238-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-239-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-240-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-241-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-246-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-247-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-248-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-253-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-254-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-255-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-258-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-259-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-260-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-261-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-256-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-249-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-242-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-237-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-229-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-220-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-219-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-213-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-208-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-202-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-197-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-189-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-187-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-182-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-184-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-178-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-179-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-180-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-177-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-172-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-174-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-173-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-144-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-170-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-145-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-151-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-154-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-152-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-146-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-147-0x0000000005640000-0x0000000005650000-memory.dmp

Download

memory/3332-69-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-70-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-71-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-44-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-45-0x0000000001330000-0x0000000001430000-memory.dmp

Download

memory/3332-18-0x0000000006AB0000-0x0000000006ACE000-memory.dmp

Download

memory/3332-17-0x0000000006F80000-0x00000000074AC000-memory.dmp

Download

memory/3332-16-0x00000000067B0000-0x0000000006800000-memory.dmp

Download

memory/3332-15-0x0000000006730000-0x00000000067A6000-memory.dmp

Download

memory/3332-14-0x0000000006880000-0x0000000006A42000-memory.dmp

Download

memory/3332-13-0x0000000006600000-0x00000000066B2000-memory.dmp

Download

memory/3332-12-0x0000000006420000-0x0000000006486000-memory.dmp

Download

memory/3332-11-0x0000000005640000-0x0000000005650000-memory.dmp

Download

memory/3332-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4456-0-0x0000000000CA0000-0x0000000000DD4000-memory.dmp

Download

memory/4456-8-0x0000000007430000-0x000000000752A000-memory.dmp

Download

memory/4456-7-0x0000000005A60000-0x0000000005A70000-memory.dmp

Download

memory/4456-6-0x0000000005A30000-0x0000000005A3E000-memory.dmp

Download

memory/4456-5-0x0000000005B60000-0x0000000005BFC000-memory.dmp

Download

memory/4456-4-0x0000000005920000-0x000000000592A000-memory.dmp

Download

memory/4456-3-0x0000000005A60000-0x0000000005A70000-memory.dmp

Download

memory/4456-2-0x0000000005880000-0x0000000005912000-memory.dmp

Download

memory/4456-1-0x0000000005EF0000-0x0000000006496000-memory.dmp

Download

memory/5144-606-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5336-539-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/5800-464-0x0000000000F60000-0x0000000000F61000-memory.dmp

Download