1b4d2248c8c181b50cf6227a2b28e6671bd6184ff75b4a6577cd394bfe2a99b1

Resubmissions

23/06/2026, 10:22

260623-meg7xaby9q5

23/06/2026, 10:17

260623-mbvntscs2v6

23/06/2026, 10:15

260623-mah9eaby7l6

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 14.3MB
Sample260623-mbvntscs2v
SHA256 1b4d2248c8c181b50cf6227a2b28e6671bd6184ff75b4a6577cd394bfe2a99b1
MD5 0470de625f0df8548f49afe62e8c88eb
SHA1 2bd93943a5965220394a2a6d5a357315a973284b
SHA512 99b92fc94df9c26a75b35c9783f7915e1473274f1779e8347dc9b3c225f2bdb85840e8e4fb0e96df4cfc41eeb902e9492b501642a3837ec420e0b5e94ecadec0
SSDEEP 393216:Hou2AF9Me31fuVDL811wmM1A5t5zk7pIHbaMgquut:Iu2AF9Me31WVuwmUA5t5zopOkqz
TLSH
T15BE63346DC200577D938DE329C14A015FEB8FAA28D78D527B706A1865C7213E7FAFB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
6072	Launcher.exe
6072	Launcher.exe
6072	Launcher.exe
4584	Launcher.exe
4584	Launcher.exe
4584	Launcher.exe
2252	Launcher.exe
2252	Launcher.exe
2252	Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c31c8c9f902dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeea63caf902dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6ee27cbf902dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0f386cdf902dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007be5e6c8f902dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021cac5cef902dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022719fc9f902dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c330dc9f902dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb3a02cbf902dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\URL Protocol	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\DefaultIcon	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\ = "URL:Run game 1335165972310528042 protocol"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\ = "URL:Run game 1335165972310528042 protocol"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\ = "URL:Run game 1335165972310528042 protocol"	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\URL Protocol	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell\open\command	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\DefaultIcon	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell\open\command	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell\open	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\URL Protocol	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell\open\command	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\DefaultIcon	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe"	Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042	Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\discord-1335165972310528042\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Launcher.exe"	Launcher.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6072	Launcher.exe
6072	Launcher.exe
4584	Launcher.exe
4584	Launcher.exe
2252	Launcher.exe
2252	Launcher.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	1964	firefox.exe
Token: 33	5968	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5968	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5968	SearchIndexer.exe
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	1964	firefox.exe
Token: SeDebugPrivilege	4456	taskmgr.exe
Token: SeSystemProfilePrivilege	4456	taskmgr.exe
Token: SeCreateGlobalPrivilege	4456	taskmgr.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
1964	firefox.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe
4456	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2352	MiniSearchHost.exe
1964	firefox.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1964	1300	firefox.exe	89
PID 1300 wrote to memory of 1964	1300	firefox.exe	89
PID 1964 wrote to memory of 2084	1964	firefox.exe	90
PID 1964 wrote to memory of 2084	1964	firefox.exe	90
PID 1964 wrote to memory of 2084	1964	firefox.exe	90
PID 1964 wrote to memory of 4628	1964	firefox.exe	91
PID 1964 wrote to memory of 4628	1964	firefox.exe	91
PID 1964 wrote to memory of 4628	1964	firefox.exe	91
PID 1964 wrote to memory of 4628	1964	firefox.exe	91
PID 1964 wrote to memory of 2416	1964	firefox.exe	92
PID 1964 wrote to memory of 2416	1964	firefox.exe	92
PID 1964 wrote to memory of 2416	1964	firefox.exe	92
PID 1964 wrote to memory of 2416	1964	firefox.exe	92
PID 1964 wrote to memory of 3392	1964	firefox.exe	93
PID 1964 wrote to memory of 3392	1964	firefox.exe	93
PID 1964 wrote to memory of 3392	1964	firefox.exe	93
PID 1964 wrote to memory of 4320	1964	firefox.exe	95
PID 1964 wrote to memory of 4320	1964	firefox.exe	95
PID 1964 wrote to memory of 4320	1964	firefox.exe	95
PID 1964 wrote to memory of 4320	1964	firefox.exe	95
PID 1964 wrote to memory of 3560	1964	firefox.exe	96
PID 1964 wrote to memory of 3560	1964	firefox.exe	96
PID 1964 wrote to memory of 3560	1964	firefox.exe	96
PID 1964 wrote to memory of 3560	1964	firefox.exe	96
PID 1964 wrote to memory of 5144	1964	firefox.exe	97
PID 1964 wrote to memory of 5144	1964	firefox.exe	97
PID 1964 wrote to memory of 5144	1964	firefox.exe	97
PID 1964 wrote to memory of 5144	1964	firefox.exe	97
PID 1964 wrote to memory of 4596	1964	firefox.exe	98
PID 1964 wrote to memory of 4596	1964	firefox.exe	98
PID 1964 wrote to memory of 4596	1964	firefox.exe	98
PID 1964 wrote to memory of 4596	1964	firefox.exe	98
PID 1964 wrote to memory of 852	1964	firefox.exe	99
PID 1964 wrote to memory of 852	1964	firefox.exe	99
PID 1964 wrote to memory of 852	1964	firefox.exe	99
PID 1964 wrote to memory of 852	1964	firefox.exe	99
PID 5968 wrote to memory of 276	5968	SearchIndexer.exe	106
PID 5968 wrote to memory of 3684	5968	SearchIndexer.exe	107
PID 5968 wrote to memory of 5580	5968	SearchIndexer.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6072

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5188

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:1668

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {5081391b-344c-45ca-a77e-40d53968e40a} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {89829660-1a36-423a-82c8-56ef44b1c3bd} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752 -prefsLen 27274 -prefMapHandle 3756 -prefMapSize 270279 -jsInitHandle 3760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3768 -initialChannelId {d6e6e68a-332d-40a0-932b-ee99c65fc1ae} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27274 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {2799293b-d9f2-40ed-8271-b0a0d1b2e126} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1644 -prefsLen 34773 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 3068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3144 -initialChannelId {3178d6b3-656c-4e2b-8a8d-458b2b93dc65} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2816 -prefsLen 35010 -prefMapHandle 4928 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {878ee0be-bca3-40e4-a6e0-e22b4c19542d} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {05982ffa-8cbe-4040-9728-23773eb3552c} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32900 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {74558a36-a48a-4b61-8ba4-f4dfe97956f1} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {d968019b-98b9-45b1-bee4-ab9adca245fd} -parentPid 1964 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1964" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:1488

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:276
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2756 2732 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3684
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 828 2788 2784 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5580

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4584

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2252

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03100235E7AEBB25C597DD91664A8F544DDFC529

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qur8qcyx.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
Size 13KB
SHA256 1bb4d8a7ed48c7579234c2a15e028d544f4c7a4a9e8ff0ef7e49ea046e2c2b0b
MD5 08dc463eac01bb3cc7e65a545efad75b
SHA1 e948dd9f41a55934258a8eaa5062298e70efa048
SHA512 4088d4fc53432a5844439ef294c50dd718b763b59c1bd45e016ae7ed1b68e809609229e977360a639d68d4d843c680d82613cdcf8564f1be438678548ef4e6ee
SSDEEP 384:HPC9iO024YQo6J+Sl1xDnZBPsac4j0lpDII+iLU:v9ZYQo0+Sl7zZlsac4ID8Lr
TLSH
T136527DBA9F023CAA1A27D195D5AE9244CD08E6BFDEE2D06505143804CA447BDF4E68CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 19KB
SHA256 99b1bac7676aeeafda0348ae5584562a8ffa46a30c435855eac27a62d24daa2c
MD5 590ad6efe620a5cdb7050e820e2dff0c
SHA1 6892d3c9429f4b7f9c701861bc941170483ebecc
SHA512 a83e1dda69e94465de9326df92b07ea305bf8c02841edf0e8c3b9166f170788250b947f9d78e2ae82d414b308e31f8f829615a85fb39ae0d5c4251f81be8c7e0
SSDEEP 384:kJWJ/Vca12krtuVm+OglBOVjeQ8RJogDghvjUSruWp5P1m59+GDa50bVyc/:w+/VcWr7l8RJnDgNjUeuwa9+GDa50bVd
TLSH
T1DF923A743AF41365F3B29F749EF1A95A653AB8629C00DB5D0162028D0977D92CDB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 20eedefa69c8ba2c2ba42dc933ea83f39ac92b3c0c7af6c23166394897bf166e
MD5 3424c49d1f078f63d2646280ab7fec16
SHA1 7c39398d76736467fb30645e541bb56842bf5f5b
SHA512 2f3ea925eae40eaf6c7c98c22e500bf6c08b5d46344f8326f6d29f25e03e42bd9ef2699d3caec1323cf83826fc8e702cfe1e7d37d13ca1bcb1033cde323b2ac9
SSDEEP 192:3Ov5zboXZP2yj68t1d66Joz0dzgCl6mc0dz:IboXZP2yjLd66JozQzgC1jd
TLSH
T1ACE12164EA29867FC418123BCCA51B404F36399B9C4E3F15369C640C2C572DE7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 898e0fa1362c9352eb48d261f3687858f3501a0e8ec2d4a5310c221b358da535
MD5 41d6de0976c8b44b3a49de84d6ec7cf2
SHA1 fed74d72ace4840530bb7e99d926825e00919190
SHA512 42555a62f818ca6db1a8f17102133fab3c49189569f5f7a29b50896aa295c302b834e1087428e596597d6447ee40967136d313b853d58656108cb960b8685009
SSDEEP 192:F1/66Joz0dzgCl6mc0d6Ov5zboH5P2yj6N:D/66JozQzgC1jPboZP2yj
TLSH
T11EE12264EA28867BC414127BCCA51B414F36398BDC4E3F14359C641C2D572EE3B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 cf6f98184b689f0a0bddfeba20e16b48a68c083d973d9abb6dfeb75675182803
MD5 65162a23f1f1017aabb053e7a9457ce1
SHA1 d7fb2c6e2b836865a9cab1451b3ae51c01413589
SHA512 3296004d65e96a2081b72a0fbcec928326d9c43a0bd2b774db4fcbaf9c3995a8c8315cf2f8d14570ca67db4bd95b3ffbf3e28dcefd2bd605488e7ee4c2186019
TLSH
T17A21375C7DF84E2AA89BE29C7491018E53974E0A45872C434D52FF8DCE91AD9326E83D
MD5 SHA1 SHA512 TLSH

Submit Download

314123e2-bebb-4096-b9b7-bfc838251f72

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\314123e2-bebb-4096-b9b7-bfc838251f72
Size 883B
SHA256 060b4db032688d916edb9256eff631d72d962c64083004cb15dea87d7d9fb5e1
MD5 819aa8e2db4723ea2be7bb772042a650
SHA1 afd0ac4ea26bc9a62864f4a1ae1912d38919abdc
SHA512 4843e23f58be3631f7c0ebf49c9d51eeceec8c8a54d2c5dec5c9161941a065481148a5cf9a21ec6380dd7a8b8958ac4ba75d944b6d0c43ebb3312d47f09a35ed
TLSH
T15B112F559930B6F2CC78A21FC95137029BE87623C0C658143EE91E140C7B90EE36FB4B
MD5 SHA1 SHA512 TLSH

Submit Download

43e0e529-08ef-40d4-98b3-27f20f1d0e2e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\43e0e529-08ef-40d4-98b3-27f20f1d0e2e
Size 235B
SHA256 0fa545f79b4399b563b57c37f326045459f54f6edfb5e4a288cda40784f055cc
MD5 597983307f40ffc8b01496f7fdabf848
SHA1 5a4413b126257ae120cff15d2f814241d45db128
SHA512 f2689599e7926b76a91b22615c46823c61e9bd11d947adc5bd83c71f8fe3829902dca15818f13c395ba90611536510c356416ca36971ef4ae5021f6ccfcd9185
TLSH
T1BAD097905CC8336C58184F43B0A068C632A44C3710B4A820E95241759EFCDCC535180B
MD5 SHA1 SHA512 TLSH

Submit Download

9b984b1f-75e4-4dd8-a793-3ddc75bceff6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\9b984b1f-75e4-4dd8-a793-3ddc75bceff6
Size 2KB
SHA256 86aefde43c12244c23b5301a87378a4eafeed1e1338b066c3e3d0d0dc62246f0
MD5 63257272728c2ef6bff5338f5114aa72
SHA1 09409b7ec7da324dd9db0dd2de524018f1331b0e
SHA512 1c5942becd965f5c04b2c442f633ede4a693eb0e64b7ccc3ad0089a5173a06a88b52bc6d4d900daa2093f53b9ffadb32de13abf170feecd60f5d80a0124b9378
TLSH
T13141215C75749CB69CDAE59ED451238D53A08F0350C228832E51DF4C8C9B79E73AA53B
MD5 SHA1 SHA512 TLSH

Submit Download

ea8e2367-492d-4263-8752-0d91ccb820eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ea8e2367-492d-4263-8752-0d91ccb820eb
Size 16KB
SHA256 0da181e5129d959b6ea39a9b6063854ec71abe70ca1ee8378d79c39cb3caca1f
MD5 22393c2fd5d72d086b85e61ad3414e36
SHA1 472b80d8f2513d93c1a9a61218fe6b791f4788fe
SHA512 0dbf9be2e79ec992ffd47b315b7985b2543a998a8ea825191c050f538129348f75ba613215b748a301ed8a32b5336d1952699e532ef19f9072ef209140ba47b0
SSDEEP 192:GjaGR28ApD3Dk47m2xa4PymsY7ziEvsR0KSbBONg1SAP9lyvYql/UCJx:UbR28SD3z62ObY7+UsR0KSb1mx
TLSH
T13372C9566420457A8291E36894FCBFC3E6F538CF4C418FCA9BE4BD086DDE0AE112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb0ee133-94d5-4a36-94ad-c17fb19c219d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\eb0ee133-94d5-4a36-94ad-c17fb19c219d
Size 235B
SHA256 2ba0ef26b17ce4e8bcda3f3b5cbe3f43d742eb143d862c3377789b5dd66adecc
MD5 e235ebd7537b97ed0872c34b45a14054
SHA1 2ea260231c0acae6576071283a96c7b65effbc63
SHA512 8af152459bda5ea18cbaf94ba8eafb2558107228f31b2e212c26e0d8d018d9f383e21e6b7397d5c8a6f84707421a13b700af9b0fd8bbfb6cb33183690b8e17ae
TLSH
T1A9D0978554D8635C08140F02B0E0A9EB31698C3324705C209D5205389ABADC4426282A
MD5 SHA1 SHA512 TLSH

Submit Download

ff2a5159-51c7-446c-9bc7-09e213c825ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\datareporting\glean\pending_pings\ff2a5159-51c7-446c-9bc7-09e213c825ec
Size 886B
SHA256 49b84b73f3a8c45174395416ed8997a7964d204c0da03a45ca43353c0fab0b82
MD5 ca2dac34a756b8292da91152da1118ab
SHA1 742e98e19d169c0e58bff09e484504d0665ecc95
SHA512 e5682153123e633b636247bb061d7f93c67d705cf274d31f3951513b6ec7e940c7f5765a7eb27b1ef940f6d1db4d13c84821eefc4759ca7c364500b51091b891
TLSH
T1D611004499A0F5B2CC78A25F98917701CAE4712384C60D147E995B180C7B65EA7BBB07
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\extensions.json
Size 16KB
SHA256 0f7cd59285076c10d8e134638b279bfc7b4e898bb67f78bcd878fb3b9fd0e8de
MD5 8f7620ebfc6f33631e05f76512f715ab
SHA1 94fa2f3184d8c74ea9d111a1c17209cf4bed95fa
SHA512 49861a7bf8ea30c34d679671ad6eb4bebe45ba1b3c1c1874c766fd21ea64b5711dce5060d2d718ea23a872fb017067ca0119d5791caedcbda991d5748b614c91
SSDEEP 384:OkI4vTUmldvOz8dhWA94zvH96oLL4HvL4PjL4H3L4Hh0nL4Hrg4hP:hI47Rf3XJ4x604T434b4BY4E4d
TLSH
T19A72531545048E78298EA79BAA367E01C37D533B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs-1.js
Size 7KB
SHA256 f8dd436ef63a453c924f440e58709a563be28bae22fa710e4b7215f616eeda1c
MD5 a21a82b1d082dec6d9f3a5363b731fcf
SHA1 94a5d32ecd5a0fef8ce9a4d50c3862e6db6027d6
SHA512 57f3774bb33a594c03057617af61a59e306dc89077a3c582b838581710feb5dcd25305087a8cfd0a83005e9120cbbe3106207ef267065016e2b4e8972fb8642e
SSDEEP 96:xHNpTUVqGqznfEu4ObzSWoQvSSl5dv9jinGSRHyuCiBw88OU0o8L4cnHZq:/NRzfEu4oNvSSVS9nBw88f
TLSH
T171F10E7894448F7F74B6767CAC6449716AB2023BBBBF78C210B95485050CF3446FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 f4523411f3a3caeb2bb1d801dd528d1fb62f1e2e608780380e923175ebe615b3
MD5 8283d8ee391d57e73a52c37860dc215a
SHA1 a2103945118c1ba80c39cfa6f00366b4165f03c6
SHA512 dd7c8f9167799caf73a569205c6342844741d4cb0780fa55bf7436b4428bad354bfdaf56affe9601d43aabf38ae262635db37891f3aa28f02c54456450a8435e
SSDEEP 96:xHNUTUVqGqznfkWA1zSlESSl5dv9jrnGSRHyuCRBw88H8L4cnHNq:/4RzfkWAIESSqS9QBw883
TLSH
T1DBE11E7894088F7F75B677ACAC6888716AB2413BBBBF68C350B55484050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\prefs.js
Size 6KB
SHA256 647aedfb6b4f33032cb0ba1e49deea3355e98f5f8c80130a7679e2bb04920227
MD5 18146da89b73cbad510aa278e4fb8835
SHA1 4cccfac48e41f3668c0906916d709395737f88f8
SHA512 f9856babc8c7e4d3f85b0564eaacd12b2293644e4e653858e466390921642885a9140d10a67308b3c376a033a2a98384f0f9b2623d97808e97f3f2ebd213641b
SSDEEP 96:xHNUTUVqGqznfku41zSWoQvSSl5dv9jinGSRHyuCRBw88H8L4cnHNq:/4Rzfku4DNvSSVS9QBw883
TLSH
T189E11F7894488F7F74B677ACAC6888716AB2013B7BBF68C350B55485050CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.1MB
SHA256 7befa75b6ebbee079bc2416dc1ab8bf928e34035c827a81aea7141c7db880e3e
MD5 f85807397acc3331bb724d1bce344393
SHA1 2228028a144bed781960b0675671f6becbe6bfbb
SHA512 ce819abc03b312d7b4338c0977e02904c2cbedc03cdce5d09daf7c3cb46bed024abaf9d33834af1057bc667072de6a73abffe49838e2161efe77651fba67b181
SSDEEP 49152:3lPbkMngvZR+Uh3YdAF5uQ9hJTHkda1NPUTD:VPbkMngRL5uQ9h1HkdQ4
TLSH
T18B1639F824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 a9125b883c1b9b7f210a6a3a48d913d0bb4bc54ecb2132c8b488a3e6f5bf51b9
MD5 fe3c0cb1fff6b93e614b040b9c4b3711
SHA1 d604fdd7b7b113826da149b31c720e4563ec879a
SHA512 d373c7cdb4a882962f6bc875a49cb38e7d92e368d087031f473da24fc7e6cef012259d356a8b029dd1b9a918e960ab58e20ff06f7d2f379a4c01a911d574ca68
SSDEEP 49152:dLRLyNaeUT6QC5zYY6SIJ5USh5Zk3WxrfiE1yLWOspM7O+C/CbuCjlKE/Y0p8qCk:R6YqCB+JqduaPkdzB
TLSH
T188665CE420E29252F38140B3719A53FB11EFC01C6076CE44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qur8qcyx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 6.4MB
SHA256 259308b54f9ca16a76526b3e5197068453b31fc7f2ea9a85fadf9ef4f21631e3
MD5 1e85908b4f4856495b66dc2841d85cbf
SHA1 ef205342c8f6513baabd97f85999419b1ffef6bb
SHA512 e7397a4a75aeee4e90c336dc23d3087f3e8b9177db84a8161ba132f04a49f81c5df969f48011e0190ba0ae1513c45ef88f1ab4520ba8c3b7bc4da84484e3cc13
SSDEEP 49152:fLRLyNaeUT6QC5zYY6SIJ5USh5Zk3WxrfiE1yLWOspM7O+C/CbuCjlKE/Y0p8qCk:76YqCB+JqduaPkdzB
TLSH
T142665CE420E29252F38140B3719A53FB11EFC01C6076CE44579896FAA5B8CEB4E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Roaming\Packet 3.1\Log.txt
Size 40B
SHA256 f6cdb0a762aa6d5e1cccb8e0de09ffe9016f11b750967e8e9dd6f6e4551e4474
MD5 3450ecb2fb96f872a8957dab62b67ffc
SHA1 6954bad4285fbe12635b8a0cc752f6dc485ecf1d
SHA512 d967fd89157e0ff4da9051ff0ff0ee2773cad6d520a201bc16bf2d0cb67857fdc3b4b34392ceb740e549f822205eaaa66ee52189f57afbdaa57e34312d84896b
MD5 SHA1 SHA512

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Roaming\Packet 3.1\Log.txt
Size 40B
SHA256 4c97f99210d005d228e2c62ba578c2781fc93013027c56853a2dd3a839626621
MD5 eb1ab22f657e17356b1b5e2540ce0694
SHA1 68ffb8511e9c3f5e53ea021fbdbba7b87e739422
SHA512 d7d6cd5fd7d5fc975ce951e5dcc941de75805b7ff74872c85cabb2d5a8f1839447a9f88568d83baeccb1a9529515da8029b017848afc799ff7dc9e713b432cb4
MD5 SHA1 SHA512

Submit Download

memory/3684-714-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-728-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-758-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-754-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-755-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-752-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-753-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-746-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-747-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-748-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-749-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-750-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-703-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-704-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-708-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-707-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-706-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-705-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-751-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-713-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-712-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-717-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-718-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-716-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-715-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-711-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-710-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-709-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-724-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-726-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-725-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-727-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-729-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-745-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-730-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-735-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-737-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-739-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-738-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-736-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-734-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-733-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-732-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-731-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-740-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-741-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-742-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-743-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/3684-744-0x000001DFEC710000-0x000001DFEC720000-memory.dmp

Download

memory/5968-681-0x000001ECD8860000-0x000001ECD8870000-memory.dmp

Download

memory/5968-756-0x000001ECE2280000-0x000001ECE2288000-memory.dmp

Download

memory/5968-697-0x000001ECE0C20000-0x000001ECE0C28000-memory.dmp

Download

memory/5968-665-0x000001ECD8630000-0x000001ECD8640000-memory.dmp

Download

memory/6072-8-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-5-0x000001E271540000-0x000001E271541000-memory.dmp

Download

memory/6072-6-0x000001E2715A0000-0x000001E2715A1000-memory.dmp

Download

memory/6072-7-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-10-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-11-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-12-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-0-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-13-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-3-0x00007FF773B7E000-0x00007FF7743B3000-memory.dmp

Download

memory/6072-2-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download

memory/6072-1-0x00007FF773770000-0x00007FF77494B000-memory.dmp

Download