d2888c0811a8284fb2c0161d534c2493e27bb4f49eb28edf83a789a170f0049c

Analysis

user interaction
yes
max time kernel
271s
max time network
274s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/07/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
‼️ Atenção, mudança no acesso.eml
Size 72KB
Sample260730-v15t4adp21
SHA256 d2888c0811a8284fb2c0161d534c2493e27bb4f49eb28edf83a789a170f0049c
MD5 cc45cd268f5e82869d084a3f94993f67
SHA1 a4db07aacbbe64e13f8ede85c09c4502fc7174a5
SHA512 7b4e5dd0ae47c6d98476b69df3592849d74b578ac2d870a704fd99cc1e4ed4349be8fb6ef83ce23ecddf37ac5bb37974af9227a1af9687fa8bbae54e3234c629
SSDEEP 768:96RcNEIW3IjzZ2BuS8jkfsQxBCBqk5Sd3TZGZdbE4q/:kRMU3nfsQxBCBqQSd3TZGZe
TLSH
T19E7396229AC02206047792A1D7622FA9EFE54143470B4DA475AF723B0FFDCD64E677AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

adware persistence spyware

Malware Config

Signatures

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe
Token: SeDebugPrivilege	5048	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2872	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 56 IoCs

pid	Process
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
5048	firefox.exe
2872	OUTLOOK.EXE
2872	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5048	4448	firefox.exe	95
PID 4448 wrote to memory of 5048	4448	firefox.exe	95
PID 5048 wrote to memory of 3256	5048	firefox.exe	96
PID 5048 wrote to memory of 3256	5048	firefox.exe	96
PID 5048 wrote to memory of 3256	5048	firefox.exe	96
PID 5048 wrote to memory of 2932	5048	firefox.exe	97
PID 5048 wrote to memory of 2932	5048	firefox.exe	97
PID 5048 wrote to memory of 2932	5048	firefox.exe	97
PID 5048 wrote to memory of 2932	5048	firefox.exe	97
PID 5048 wrote to memory of 2232	5048	firefox.exe	98
PID 5048 wrote to memory of 2232	5048	firefox.exe	98
PID 5048 wrote to memory of 2232	5048	firefox.exe	98
PID 5048 wrote to memory of 2232	5048	firefox.exe	98
PID 5048 wrote to memory of 1480	5048	firefox.exe	99
PID 5048 wrote to memory of 1480	5048	firefox.exe	99
PID 5048 wrote to memory of 1480	5048	firefox.exe	99
PID 5048 wrote to memory of 4308	5048	firefox.exe	100
PID 5048 wrote to memory of 4308	5048	firefox.exe	100
PID 5048 wrote to memory of 4308	5048	firefox.exe	100
PID 5048 wrote to memory of 4308	5048	firefox.exe	100
PID 5048 wrote to memory of 5588	5048	firefox.exe	101
PID 5048 wrote to memory of 5588	5048	firefox.exe	101
PID 5048 wrote to memory of 5588	5048	firefox.exe	101
PID 5048 wrote to memory of 5588	5048	firefox.exe	101
PID 5048 wrote to memory of 5652	5048	firefox.exe	102
PID 5048 wrote to memory of 5652	5048	firefox.exe	102
PID 5048 wrote to memory of 5652	5048	firefox.exe	102
PID 5048 wrote to memory of 5652	5048	firefox.exe	102
PID 5048 wrote to memory of 5744	5048	firefox.exe	103
PID 5048 wrote to memory of 5744	5048	firefox.exe	103
PID 5048 wrote to memory of 5744	5048	firefox.exe	103
PID 5048 wrote to memory of 5744	5048	firefox.exe	103
PID 5048 wrote to memory of 5756	5048	firefox.exe	104
PID 5048 wrote to memory of 5756	5048	firefox.exe	104
PID 5048 wrote to memory of 5756	5048	firefox.exe	104
PID 5048 wrote to memory of 5756	5048	firefox.exe	104
PID 5048 wrote to memory of 1320	5048	firefox.exe	105
PID 5048 wrote to memory of 1320	5048	firefox.exe	105
PID 5048 wrote to memory of 1320	5048	firefox.exe	105
PID 5048 wrote to memory of 1320	5048	firefox.exe	105
PID 5048 wrote to memory of 5300	5048	firefox.exe	106
PID 5048 wrote to memory of 5300	5048	firefox.exe	106
PID 5048 wrote to memory of 5300	5048	firefox.exe	106
PID 5048 wrote to memory of 5300	5048	firefox.exe	106
PID 5048 wrote to memory of 6048	5048	firefox.exe	107
PID 5048 wrote to memory of 6048	5048	firefox.exe	107
PID 5048 wrote to memory of 6048	5048	firefox.exe	107
PID 5048 wrote to memory of 6048	5048	firefox.exe	107
PID 5048 wrote to memory of 3000	5048	firefox.exe	108
PID 5048 wrote to memory of 3000	5048	firefox.exe	108
PID 5048 wrote to memory of 3000	5048	firefox.exe	108
PID 5048 wrote to memory of 3000	5048	firefox.exe	108
PID 5048 wrote to memory of 3892	5048	firefox.exe	109
PID 5048 wrote to memory of 3892	5048	firefox.exe	109
PID 5048 wrote to memory of 3892	5048	firefox.exe	109
PID 5048 wrote to memory of 3892	5048	firefox.exe	109
PID 5048 wrote to memory of 5280	5048	firefox.exe	110
PID 5048 wrote to memory of 5280	5048	firefox.exe	110
PID 5048 wrote to memory of 5280	5048	firefox.exe	110
PID 5048 wrote to memory of 5280	5048	firefox.exe	110
PID 5048 wrote to memory of 4352	5048	firefox.exe	111
PID 5048 wrote to memory of 4352	5048	firefox.exe	111
PID 5048 wrote to memory of 4352	5048	firefox.exe	111
PID 5048 wrote to memory of 4352	5048	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\‼️ Atenção, mudança no acesso.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2872

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27100 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {45186adc-e7c0-4dbe-8d6f-ab2782198102} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27136 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {169af954-d614-4a83-98e5-07fb99c60709} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27277 -prefMapHandle 3808 -prefMapSize 270279 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {23acdc41-0f28-4f1d-bb0e-5f8ea7057dac} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3804 -prefsLen 27277 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {c1998b0b-1e0d-4569-a6a3-76cef51c2fee} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2868 -prefsLen 34776 -prefMapHandle 2872 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3700 -initialChannelId {06905a70-b00b-43de-8f25-674c482b8112} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5012 -prefsLen 35092 -prefMapHandle 5016 -prefMapSize 270279 -ipcHandle 5104 -initialChannelId {aa8333ff-f5fa-4d5e-89e9-e0659f33ab14} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32979 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {ea292cc2-0c56-4742-9d7d-c3f7921007d5} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 33031 -prefMapHandle 5252 -prefMapSize 270279 -jsInitHandle 5256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5452 -initialChannelId {611dffc1-2a26-4249-b241-bb85aecf2815} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5804 -prefsLen 33031 -prefMapHandle 5808 -prefMapSize 270279 -jsInitHandle 5812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5820 -initialChannelId {26d364d3-ee2e-4a3a-8add-ace6650dc9d7} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6188 -prefsLen 33071 -prefMapHandle 6192 -prefMapSize 270279 -jsInitHandle 6196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6204 -initialChannelId {c9bc420e-9fa0-4ed5-9744-ac80704b7529} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 33071 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {559dfc11-2720-4263-95aa-0b86035d5afc} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2960 -prefsLen 36757 -prefMapHandle 6652 -prefMapSize 270279 -jsInitHandle 6080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {1d09bcb4-126b-4bcf-aa5a-542bb5b22705} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6860 -prefsLen 39877 -prefMapHandle 6864 -prefMapSize 270279 -ipcHandle 6752 -initialChannelId {95dab80f-2c47-4efc-b0fd-557f7b34f94c} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 utility
    3⤵
    - Checks processor information in registry
    PID:3000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6788 -prefsLen 36757 -prefMapHandle 7028 -prefMapSize 270279 -jsInitHandle 7036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7032 -initialChannelId {cedfdd85-cc82-484f-93b6-20d57e0ba556} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:3892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7296 -prefsLen 36757 -prefMapHandle 7300 -prefMapSize 270279 -jsInitHandle 7284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7304 -initialChannelId {173fb14d-7370-4fea-87b3-524b0840513b} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:5280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7584 -prefsLen 36757 -prefMapHandle 7556 -prefMapSize 270279 -jsInitHandle 7596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7608 -initialChannelId {be1e9cef-f9ee-4370-b87f-e49cf1012ed6} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7820 -prefsLen 36757 -prefMapHandle 7824 -prefMapSize 270279 -jsInitHandle 7828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7640 -initialChannelId {a7d25d78-1756-4914-bd47-0b1d27718532} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 b175434050594d9bc0729853e2405b87c6f74c93a5d2ce2ac98a788a347a0b88
MD5 57c6ced388def7399fc1cabe131fbbc5
SHA1 8495cc398a4db859414b0a0c19c54d6b094d8344
SHA512 930de1e786065b337bec92c3aed9c5889a36eb5ba7c453a1edf5344d5e2d6317c042b7fadd08672724c191b8924d57f5ce6f8faee13a185d8b8afeea96e54f61
SSDEEP 384:HwCe7iO024Yndcs3hk2nhfdDE2Ba/rIVy8eBIu+FIu+i:QqZYndv3hk2nhfS2sDIVy8i+D+i
TLSH
T145729EBFDF516C5D1917D989C8AD93669C05FAABCFF690A608243449CB84326B0F60CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EF0C12E88F426B906C78B4C55262EFEC1DE932B5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\EF0C12E88F426B906C78B4C55262EFEC1DE932B5
Size 120KB
SHA256 979cb6db6a6a8b03d3c414818946c60f891815d7223b931e1544aa5317c11788
MD5 9d68bfe1b66ba27582e16c58938694cf
SHA1 df1e0e62c66ad6bc24ad0ff6b0c2806b3c84b808
SHA512 f66aa81a0aff12cc2360a3e8dcb739bf1e76737fe99b83bfb20eb9cb4da29dc1eaec6683728400697cdd680b75347385a5a209134fc13321595f8cb3ebf839ec
SSDEEP 3072:fVRwyoNhxwdBjwOwOSB4ZWQZO2CR9VBbLpoFbG:fTwy+w/jwOwOSBAWXjBH
TLSH
T1FBC312766A271B86C2C0C6D7426BF95D7E2830C3FAD9FD1E650093979AE09A49C4F0DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 21KB
SHA256 0ede095f02d051aad212b062cee7cb7d4dc15eda07ad2bab70090e0549cedc3e
MD5 90793c0dd96de70ce553c90bd75f1612
SHA1 257ae0165f294684c03bd2f903abc0d7e90be1d1
SHA512 783d51f5c9d341e3fe87ad9bd5310ade926a84f8e81c3892d77025bc462dc5e0026c6fe7e3541d2456e37eefe6c13e888dace18f38fbacd2ae5cad249a1294a3
SSDEEP 96:HNQlRUQ+3BEvQ+vI56Hsi7LeM/pzgyx2mYyuZmvy8tHY4DG9GjG:HNtQK227ZZ2Ft
TLSH
T197A2D7F737F2B022F5A28FB44068B44D8C33131959A99588CA44C0B756C67E6E07FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 22KB
SHA256 d6d7f7055bfc0b6eac1f6fe80d9a1b365a0bde0553df89674e6da2918bc846b7
MD5 3ec82b7a3c335324e4a646c26e5644c1
SHA1 596f7d4ea91dae54cbce95862406f8eae20ff10f
SHA512 39570badcccf4c06a2f40c2a5d881a73ca1d0e891cfa994ed99956999af42c5f01d11362cd054444763f5592451fc11961cd6b017e97e61a20a9fa9835c816e4
SSDEEP 96:HNaQ+eM/pzgyx2mYyuZmvy8tHY4DG9GjG2AGhGbG:HNdQK227ZZ2Ft
TLSH
T1EDA2DCFB36F27012E1928FB49468B44D8D33170959A9958C8B84C0BA13C27E5E07FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 22KB
SHA256 96a1ea9cd0ca408151cb79190626137b5a26f51d604ca828e4556b126e701aa2
MD5 1351b0f16066f67fd4b10ca9672c717a
SHA1 ada5e7b608ac9a5b6591938bdfff449eb4c9317d
SHA512 792267e35091a8a52eba0e9085d891b0ade1c8d88a838efa13831aec5ec1f62c233e83e43d74a411bdcedf7b817ee860e35fe55dae6fcd35211f68cacb33f683
SSDEEP 96:wNyswm3NhjQ+eM/pzY4aG9GjGG+GhGbG:wNLNhuQ
TLSH
T161A20BFB37F2A411F5928FB48468B459CD33171959A5968C8B84C0BB12C67E2E06FF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 10KB
SHA256 d68301bc3525be5a0891e8d4daa0d7220986aadaa1a5ad1e0eaac57381f76939
MD5 4945b9eeadcf91b123c31d7ee9170a4a
SHA1 cd8d990bd5449b971fc0f7de2e65566ecc1e3dbe
SHA512 7671fe79be30399f87278c136e9fd6e99eefc6156cf78bf035bf3b289a8d20eb3afb8bd41e8f274135a88eb69c0559658284d54e9e17802657bb41e152653628
SSDEEP 24:nuhMZr491nQ9x4j2b9BEjw9VvejX9FTq5q9F55A5Yf9ln:YlaKuG6BCtNYI56YFB
TLSH
T14B2294F76BB6E462F1A2CFB44068B54C8C33032549BD9585C644C0F716C2EEA913EFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
Size 17KB
SHA256 cd041882a2accb5ce61fc514d0ff0764c14da2a2bb80bbfd553d1b97dcfc0498
MD5 ac40e65c189f32ddd98969896ffe8c01
SHA1 b68bc16dff6eba2604e000dc18262e571aa8afa7
SHA512 431b87ada9263848338619e3601c980f954a2989b034a52c7f0fa21516a19f5c8d202c41d4259b2d340b17189aba2e26c30b9e5db4537a69ee8f509955c4cc3c
SSDEEP 96:+lRUQ+3BEvQ+vI56HsicwOM/prVyx2xtyuZxry8tfe4:rQ322LZZlFt
TLSH
T1C582A5F73BB6A462F1A28FB44468B44D8C33432548AD9585C640C0F752C5AE9D07FFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6e204c780b595fabfa8ba9bf18009bc1a3db594b0d6375e41bb253f3a8297abf
MD5 4e0c94064cd04a06f90624a19d644876
SHA1 500c9969591ed7b36aa3e04becd758c96fb619f8
SHA512 891d8d815512131bbc8638fd28a02f91da21cb0b3b279ee0e9045e1b2bca8fcb46cc114bca184cd41fea3dc62df5ccbec02d83ed5d1b283544e7b9dd3fef1415
SSDEEP 192:uy1/66Joz1zgCl6mc0d5Ov5zboA5JmyjsQ4:X/66Joz1zgC1joboyJmyjW
TLSH
T11CE12098EA28867BC404037BDCA11F510F3A389A9C4E7F29359D601C2D972DD778E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 37KB
SHA256 4642c629df3b6fc5a77e9af1a18a7efb62d34381f2601253c4e237d9b726e093
MD5 96f300797ca8302dcadb7bdb6c3defe6
SHA1 0869aae43f9587ff83c03faf07d32f3a97a250c5
SHA512 0415185143493652b08ffdae4c12b4bf18c9b99e68981a2e57bdf09cba5630b7bbc6bb4317f88255454002b879b40f9162f773a37c797c9d63dfa0bb7cc1d476
SSDEEP 768:PNDPetqE/yed+ddsVlGcmhuR06K/tDrgLjb9bhbCbkcb:stqkyedss06Zk
TLSH
T198031144EB2E953FC42502BADCA51B102F79F885591A2FAB3B4C55686C872DC3D8E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a33a4c96b14b16b8822d8b45e4e56f2946a16c5121deac3b1a61e940ba714bcf
MD5 0ab1873c96b3266931c228a7d91018e1
SHA1 3b12b10180996e1af370f727ad52750deddffbee
SHA512 c8ccee849e35e85ddf54e010210df930fb214b938871909b28c3543bdf637bf65075067cb5e30a28af05524e564389527899eb6310a0b3663c9a68b611dadbe4
SSDEEP 192:4Ov5zbotbJmyjsppp1d66Joz1zgCl6mc0dz:DbotbJmyj0d66Joz1zgC1jd
TLSH
T18FD10064E628867FC444023BCCA61F410F36385B9C4E7F2935EDA5182D972DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 bd210efbfac22fa9eab4922d4323357269e3f77bcf558b5fec80de9b629f1be4
MD5 201de6d323b17f1c6d3b649fb42735b9
SHA1 a44c1dce29351873823c8b83fce74438b4b82577
SHA512 06a88b6505785cf9f6876226b608302b146e7b91c3403895d5e697dd675d5f2b8d40d5a7c25bc63d5387c4c5771bed84f62267d0161e94ee69ec3539d25226e1
SSDEEP 192:3Ov5zbocbJmyjsppp1d66Joz1zgCl6mc0dz:IbocbJmyj0d66Joz1zgC1jd
TLSH
T103E10064E628867FC444023BCCA51B410F36385BDC4E7F1935EDA5182E572DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c0912210824ab2bfeaef2f9067408162b65e35574efab60f0c1216f00c0140a7
MD5 7865148cac136997ca96083f1055cf7f
SHA1 5e6af1900608335a9fac4cbd7437f762ca5be712
SHA512 706f421a112a4e754a69832ef79014bf36125ffaac9ab7111517aace5967623e542cf7b7063fe64e5c83ef0c8f598309749a3c9d8b71d22528dd7b1135e7a27c
SSDEEP 192:wp1d66Joz1zgCl6mc0dyOv5zboAFZJmyjsp:ad66Joz1zgC1jnbocZJmyj
TLSH
T114E10158E628867FC408027BCCA61B410F36389B9C4E7F2935DD651C2D572DE768E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
Size 5KB
SHA256 102a10889dd37de6729685fb0aa02832c2c9c06681ef7d4515036e06c7d22112
MD5 acb0d2444d56eb7afaffc61362dbeb7b
SHA1 4fe562008532f2c127e750fce67045a03e21df09
SHA512 2485ad48e44341e0d2a8b799991c8388031dcd053a89e91112dd0b6a35197c062dfd582918a0a4ac90726c7480146b8bdea1cbeef04d5aafc9b61952fedd8b62
SSDEEP 48:YpBI3bnRfLlq6WKFOgZBi/AzMPZG1ZHHGtpMfQ43puq2sdhHUYNKdXw20zxkm1FG:nQg18mRfQ4xdSHd30xPFrsp8S
TLSH
T1D7B10E1C36A91CBF2ED7D39DB48106CE46C88B03C5C71D874CD7EE598D8AA99325F429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03c52f41-7b1a-4d8a-8854-4177f7e811e5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\03c52f41-7b1a-4d8a-8854-4177f7e811e5
Size 2KB
SHA256 322e45f9c7fa25b67c22fcfdf5deb6d08cc383733f92a7fa7533394e511f0d9d
MD5 e44400b066376031178c8768e965d64a
SHA1 b554e37ccc162ef765c2a84c4fa1b7958616c5ed
SHA512 aad76a7b34cf5a9c8bec54f830463e331447b9be8d1f0c7528629b0637730193a33a1dbbaa05ff8934ab8a4303084ba4f2ec1921f908ddf80e9ca91e020cbaee
TLSH
T15341415C75B84CF78DEAE18DD48227CE57608A4340C768872E53EF0C8D9A6DD332A47A
MD5 SHA1 SHA512 TLSH

Submit Download

0b037ea6-572d-46fc-8603-2fc1f82a4272

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\0b037ea6-572d-46fc-8603-2fc1f82a4272
Size 886B
SHA256 9478ab17bb8d8cab68ea9db628ae28342efb457f6490f2f60cc835b4a5097790
MD5 4ad5cc1f94eb76415352fc016a095e64
SHA1 2e8396509fb582831604acb93fcb4d5ec2aaeb09
SHA512 b07a8202839d91c0ed02356f92d58a4216fa17c2d22a680ba7e86c73f578a8ffc2f176e9980d1551595ef65017d542f0a21ead905eb0c8ddfe8b03731c6fc5f7
TLSH
T1111100819634B9F2CC78834BDCA1BB4247E47123C0CA58083EA15B180EFA55EA35761B
MD5 SHA1 SHA512 TLSH

Submit Download

5337811a-d47d-4954-adc3-e8741852a04d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\5337811a-d47d-4954-adc3-e8741852a04d
Size 883B
SHA256 f5924393e9c3284742e6e3c6b91383310d680a044b15ff89ddf0e0afd37dfaa0
MD5 f9009fbf05bc75572ed50b01d1618b84
SHA1 27dcad3d4dd07452b56edf9ea14ac51ea8fd5843
SHA512 e8144b02219ca593edcd2a258d0d660511d35f68533e5853de344d501d7f4f86a59cbfd905c603c2d44ef122bdc4d8d62282d5e399fc0148c84f05ad566db54c
TLSH
T1E8112741C53079F3CC78D20FCC953B424BF47123C0C6940C3DA25A180FBA95E936A657
MD5 SHA1 SHA512 TLSH

Submit Download

6e96300f-5212-4ede-960f-360cf956e232

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\6e96300f-5212-4ede-960f-360cf956e232
Size 25KB
SHA256 d85f5873053258f447fa5091c357df30fe2afaa9f040bec53a6d9d4fe593191d
MD5 381b1ed951bb0676f3759c8fb753b45c
SHA1 7295290be7ac5d9f094f8d6e767574ef52caa4a8
SHA512 446c3a05dbde9946ec7fac7cda59b397a7996af2a65aadd2d822638986260b920414a2e61de50c201b760e364cb56d8d64cb06867a2ba8e9a1a47c6a1bae85d9
SSDEEP 768:voxok3TyrkAzSzJ3XFhaIfbqBAYmpvEeNw6hL:Qx+TQ31I2qBayAwy
TLSH
T1BEB2ECFDCD1240473E65E52EF2E9AD6B2057283209CDC7DD6AFD483A26C69BB1127318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a249c6f4-27c9-41d4-bcb2-1e19d80c87e6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\a249c6f4-27c9-41d4-bcb2-1e19d80c87e6
Size 235B
SHA256 d0024f0c00166475b235b268b3ddec8c0456deafbe8f70868f069a85b0abd20e
MD5 26dc1ea6879b893ee737375b7f071ea0
SHA1 bb2013eb8ef6f16163de38296b16ff0ef907c862
SHA512 8eb965b21eca3e4bada980642207d5ccb2f97c161f9e190a6d6043660ecf2dd8cb393ddd487c1c259ca5c307b438e597ab95af4bfdcae4eb4ba8666347c669c8
TLSH
T120D09780289C63AD18080F07F0A0ADE3704C8C3B906098108A608138C9BCAC9816285B
MD5 SHA1 SHA512 TLSH

Submit Download

abdfb8b5-6f89-4b42-8edd-d20bf62866eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\abdfb8b5-6f89-4b42-8edd-d20bf62866eb
Size 15KB
SHA256 d8efcc96d7e13487f03dcd7aacec91fa87e520663a1076bebd890819b3371f62
MD5 1c3bc66dff892501e5705ee8a3367438
SHA1 409f583f8a941cc88fb6a6cedd38b157d69a4ef3
SHA512 aa8410bc7e02af0c748926c247bccba0efb0c4040511f4e53b74c31dc30c609d2fc8e989c81a8966a3472dce4f69845a4db98c8733aee997039e32da64096fa6
SSDEEP 192:PVw8CuGTT1yiUZBj7i/LzVRXbYMhzR+zybaCdlV+L5Jagz8ttDvDUbhVsRy66ovv:9wjLxUZB7i/LxRXb9zszBuMOGGu8n
TLSH
T1A772E916282045BA8651E3A8D8F8BFC3E2F538CF4C419FCE9BE47D0829DE09D112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fbefdf02-4ff5-42be-a1d0-d189fc4d7d85

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\fbefdf02-4ff5-42be-a1d0-d189fc4d7d85
Size 235B
SHA256 2cb3232897ed6716020fb7dc34b83f8de4f7c73141e06f8a675a366f488e428f
MD5 96318348205a3ee475fd10f0ca64066b
SHA1 a28de10c26b17cbcfe8487e9f33426c38e01cecc
SHA512 b4abaded548d5b85010f1b598a2d382c0d402680a4ba826b00fb3e4c00d2da8e4e002a7191a28774716f6fcc17dc6ed5491e9651384a39199766b313f59399b3
TLSH
T193D0978218A8A32C0918AF0BB0E078CA30544C33A0B59820C6900038DAB9AC8529284B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\extensions.json
Size 16KB
SHA256 3ade5e31568da66cbb8746797b62707f696fb580ac0050bfbb89f694fae2da18
MD5 82cf03698978838eab4c64e96bb391b9
SHA1 4415b32d595050dbdd64c6bc47ac2cc9898f4163
SHA512 ec7b8d995c5415d6ecae85b06ff2cb3c909cd16181604fcef10ccd9eb3e95acf374b972f6d3dccff190730f5d67688d587d3dc3515f11262c2e8db43c6c3de2b
SSDEEP 384:7kI4vGUmldvN8dhWP94z+96ofL4HwL4PVL4HZL4H1L4H3t4hQ:II4+Rf+X64m6w4S494x4V494C
TLSH
T1CA72511545049EB8298FA79AAA367D02C27D433B60855C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 1e85b826b8ae8f10cd87753a4cd32597db0ab6546a50a296fb07eab03e757156
MD5 34281d3539ea6a3584d05e42aba7d158
SHA1 2080bc513abf19f8b6ccc75e4e9f33b003990b29
SHA512 ac36325945ec71782e5e4bca771a124004438e7a4635f35391b4977c5a2f4e14e3b4534512feb6daa99afd92cf8d020c34f61616c781e6e2524af087ad4f8786
SSDEEP 96:xHltPUTUkqGqFQPfadYkzS4SSlndv9jkinfyHVd7Bw88P8L4cnsr1zTGS:3tPHR4fadYCSSCY8Vd7Bw88Bhl
TLSH
T18BE11F7891088F6F64B677ACAC688C315AB2413BB7BF68D750B684C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 6KB
SHA256 8919332debdf29026e543cb3d098d6cfc5c8b720be1d68c218fbfcf9803f6884
MD5 c5113b044fdabdc351c70d97362d9f70
SHA1 3eaa2c98537862a647f05ebca4d0d2204445ec1c
SHA512 c8eccbdd245327bc2f147f79a776275bad1050a64f5b93e2a91d87da780a9dee3dfee7c5585f27d582f51266509ce0b6efb9fe1387a30ad57935729de55538de
SSDEEP 96:xHltPUTUkqGqFQPfadY1zS4SSlndv9jkinfyHVd7Bw88P8L4cnsr1zTGS:3tPHR4fadYJSSCY8Vd7Bw88Bhl
TLSH
T14BE11E7891088F6F64B677ACAC688C315AB2413BB7BF68D650B684C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 12KB
SHA256 6fb0e11872a5b374c63b8c099d63dba83d29e5455d1ef26772b85acca2787b86
MD5 49de7db9c76bbc60be9c49c1641a19b6
SHA1 11992f080ee70645636f3992d1a1afa9fdc8a3c3
SHA512 ecf132708cccb0626bb024027c270603aaced9291fb1d06ae687e1ce99f60850e362d8a2f6dd8b6775c14b231d7b3f6753f82299db19324f0cc2a6966e944785
SSDEEP 192:3tPSR4fWdYOSSCYALRgdKOBw88CA3KHruW:3HJDRmwT6yW
TLSH
T15042DE386084DB3F25F2327DAC218EB119614227B6BFBCD345F9D892145CF2441E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
Size 8KB
SHA256 56315fb9800b6f7894dacabc63b5142457d87e1475ff68adeff8b3ad11ec3a70
MD5 049cd35b9cfd5d3169131a57d340f825
SHA1 f37b010a1002e0b7065daab31d1ee0b89ad7ed56
SHA512 ba0bcddbd5d22ce3485e6981e4ade998b20907db7a97f08f0429ca3df8a54d04fa12b254736c7d2308b22fd7033c1eaeba0e0312c55578230d71ea34b092bd48
SSDEEP 96:xHltPFTUkqGqFQPfWdYNbzS4SSlndv9jkinfyWRO5dLsBw88m8md968L4cnsr1zp:3tPSR4fWdYNSSCYpRgdgBw88+9uhl
TLSH
T1E7122038A044CF7F64B2366C6C248D3159A2423BB6BF68D310B994C5014CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 50e62dba530f1ed7277c124ee5ffb0dbd553fca00ef1181ab7a497c281ddb17b
MD5 9dc6d937731738334f3707c90d59ee34
SHA1 c6bfba8c10f35521cc318f4d6a4889a862d3d008
SHA512 75b509dc79158b53038eca9e2334bc345a602f166555448ae95f5b392b6d7b0df5f54ce8a2bc1c170df82e440d705d4fe418c6884a92235a322ba1be955df0c8
SSDEEP 96:xHltPUTUkqGqFQPfaHm1zShSSlndv9jCnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHmASSe8Vd7Bw88Bh2
TLSH
T1A4E120789508CB7F64B677ACAC6488715AB2013BB7BF68D750B654C4014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 7KB
SHA256 3bdc6c527b06333c6595b3dd99ae6f93f5089f79bb73e1a82ab6c7bb00fda8c2
MD5 ba534e47026f90ef723fb12b2910300e
SHA1 87fb1ff9422384a7d93386116e421fa400316bf1
SHA512 2341de6ac1885fdb5474d441b8a64ae946d90ddfbb8ff8e57aec469510fdd7bf3297e5e4923021bec6b4860a1de77962527e5b68217dd84ca015fc89ea614f4b
SSDEEP 96:xHltPFTUkqGqFQPfadYNbzS4SSlndv9jkinfyHVd7Bw88ms8L4cnsr1zTGS:3tPSR4fadYNSSCY8Vd7Bw88xhl
TLSH
T1EEF10F785108CB7F64B277ACAC648C315972423BB6BF68D710B594D4015CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
Size 6KB
SHA256 a7cfdecbff9b8590035367b24a14e98b6f18fd34ce82da9916d38a8e68d40355
MD5 4bfee04e432d1c2d485e293e0aafb506
SHA1 b4061893b9879d4adc27431721f7b03fbfbd270e
SHA512 0a54f2271d0c2b1792bd61fd00a35c154de041a930fe1e53bb7980b4a19fe2ec5dcdcb59c32a35ae50d877294a2fb96184dc492498620ecfcf2c173bb3da4e18
SSDEEP 96:xHltPUTUkqGqFQPfaHm1zS4SSlndv9jCnfyHVd7Bw88P8L4cnsr1z6:3tPHR4faHmJSSe8Vd7Bw88Bh2
TLSH
T129E12E789508CF7F64B677ACAC6488316AB2013BB7BF68D650B68484014CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 04c9dc2a4eb169edb0a8fcd7b71327ccb307a322a23595ff17902c3510931f4f
MD5 40dbdc14898f540d6ade2cdbdd2cd57d
SHA1 d21d748a0d980710c7061a3f21e4364348440699
SHA512 b84e15d9e6bc89bd88034c1bf745edfba3c58b87bff2c02614641f3a053371200054b03c43c613da5634bb5df59e0cec47c7c0a37c1c46f1f9be76a61aa5e4c3
SSDEEP 96:f2z2jlH9uYZ5tunOIbCCd01VrqM4EcZZi6rLKJyjbvuwm:fXp9uYH4nOmCi0v/4Jb1m
TLSH
T18F917EEF68257CE7AA72C8948CEF0FD505E2108549F902719E38AEB101AC7546A5851F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 96KB
SHA256 1cae079f2bee7f6ae94b36cec4c512d55bb6d69840c19b0c3c68be5f205aee26
MD5 a65b977771a21a67f00b8db486190101
SHA1 12e8fe9cc4cdc3616a03394a8624532055e3820b
SHA512 08d47fc88261356d84745267401e2990bd670b4a0cce7dcbe759e53c0217f9f7ce23278f462817fbd48ba5940401e208e1a5e60e69feb2e2f256d7ef86591ca7
SSDEEP 1536:fS0a0YZfEH4QeY4axEKaOgRucjfV/Kg0UEFEJLJ2LP5OlLi1Bf7UJ3H30UA2rVTm:HgMH4+4axpIL9JD8T5Ue7wH3/7m
TLSH
T1DCA3D1E0473735700D23A1C5A0D92A7D4EF3B80D9E5B73AC98552D949DD3BE88E2A62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 71549c2f16c1e85ac2dde6fb2f004528413642db7a3bd17a1a2e1ab0931fc969
MD5 3264427c722f35f0ec6a0285bbcade97
SHA1 15fc740af30d1e44a08bbc48ebb3b5dbbc9545eb
SHA512 e3435b443916254684def3a4068b60e68594c2fb60f0a4d0200be1ba48f7f0d5ac0442cfe4ff103074221dfd0a9ad0bd6bc21694906319f3b6c72e1d61fa1bc0
TLSH
T1B9517E370C2B2CFB3572C2DE94CF0FC08552102004E994A5BD79FD2101FC605A795A5F
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 191KB
SHA256 be2d4762263b033a40e9fe64d1b3f4a5a3771638aa226f68e72613616222b426
MD5 97eefbd36d7b5fd70001e9b3d06120f2
SHA1 586a3543061ae6a6aa6b3c5ff787a59266622aa1
SHA512 2932e51c35e02a124119a9babd1a59eef6f08af366494a92a34c65be24c0c03cb87cc3e3bae69e90d11e5e3e6d4c21b55a79ca9e3c1e4497a776d377bcc624ef
SSDEEP 3072:cgMH4+4axpIL9JD8T5U27wH3/7p2XA4C43RpIo9wD8T5U+7wH3/7A:cgMYvaPILnq57wXYXTL3vIo8q57wX0
TLSH
T17D14D1F0473735700923A1C5A0D82A7D8DB3B80D9E5B73AC995639949DD3FE88E2B52C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 9f035669911ad36210924c9d7b14bc7e49e75301e73ffbbac7d2bc9f1b9e612f
MD5 9b17eba19ecb16095879ed7ab309478c
SHA1 7a0bfd2f82643727627e43d945a9cbb5d3b0a56f
SHA512 3e770526d5b26cb3d60df876e2a3469f228253d768bc0a2299a9b02a5bc281213157030bc27cd1b783916642eb41fc5a88b13095b89286ed7adba4acbe8c6cee
SSDEEP 96:f2z2jlH9uYZ5tunOctPCCd01VrqM4EcZZi6rLKJyjbvuwX:fXp9uYH4nOc1Ci0v/4Jb1X
TLSH
T161918EEFA8257CE7BAB2C8D44CEF0FD505E2108149F802759F389EB101AC3946A5C55F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 96KB
SHA256 e5406a45c58cc33f3230cabcd8f1bcf8bffdc9ecb55f4607fdc3113d05cf9328
MD5 6cfec93ea767578395be2b78339829a6
SHA1 13673620edb1d2c7ab7457c2a2adff0fd307f3e0
SHA512 d6a288ada4c5f60f90ca4631040070a32408d7e95a2f949d4f0a0bcafb1cb6bb7bda61027d0e655977c2b9a05135441ca39cebcdfbd1eae89aa278be1c81fcdb
SSDEEP 1536:KS0a0YZfEH4QeY4axEKaOgRucjfV/Kg0UEFEJLJ2LP5OlLi1Bf7UJ3H30UA2rVTV:0gMH4+4axpIL9JD8T5Ue7wH3/7V
TLSH
T1A3A3D1E0473735700D23A1C5A0D92A7D4EF3B80D9E5B73AC98552D949DD3BE88E2A62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
Size 191KB
SHA256 c66b376f3ab7d29984b049f55aba59e51687290a66d37c8203e6889d9009769f
MD5 aa09f8a372da86ca6ff41cbdf5f2d503
SHA1 5258cf0f66e88a5d1aebccfe81797f81043fb4e5
SHA512 59e88ba005a7df641956218fe034a892f5159664869ab6759128914b1da9c4cea5ec78bcd07aafb2343d40b38372f18a23b7b0db2980a473930d9bba381fc5ad
SSDEEP 3072:XgMH4+4axpIL9JD8T5U27wH3/7Hb8A4C43RpIo9wD8T5Ue7wH3/7V:XgMYvaPILnq57wXv8TL3vIo8q5jwX5
TLSH
T10D14D1F0473775700923A1C5A0D82A7D8DB3B80D9E5B73AC98562D949DD3FE88E2A52C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 0e7815bbf483ea49acb0b0ef66c9727a727ffcabe6665a12da90109ab27ab61d
MD5 044d1f6a8632c050913c8eb4e497d726
SHA1 d45dd9f215f14673ddd551ebb40c9bf2f7cc80b5
SHA512 56c1e71deae331d26d766c19f14808565e4dbfc5481eca0c065761c278780684b5ec37b4ffd5bc7e6a1dc711343731f1613ca6b96af158e73f3f7173877382f0
SSDEEP 49152:d7wufsFyaP6ryPt+Qd1hJS2sRz3UghkR0bPGYhpquc:pLfsAaP6ryPt+QCRz3UghkMq1
TLSH
T1932629F820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2872-9-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-15-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-13-0x00007FFEFBDE0000-0x00007FFEFBDF0000-memory.dmp

Download

memory/2872-12-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-8-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-7-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-6-0x00007FFEFE010000-0x00007FFEFE020000-memory.dmp

Download

memory/2872-14-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-4-0x00007FFEFE010000-0x00007FFEFE020000-memory.dmp

Download

memory/2872-11-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-17-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-5-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-16-0x00007FFEFBDE0000-0x00007FFEFBDF0000-memory.dmp

Download

memory/2872-3-0x00007FFF3E02D000-0x00007FFF3E02E000-memory.dmp

Download

memory/2872-10-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-49-0x00007FFF3DF90000-0x00007FFF3E188000-memory.dmp

Download

memory/2872-0-0x00007FFEFE010000-0x00007FFEFE020000-memory.dmp

Download

memory/2872-1-0x00007FFEFE010000-0x00007FFEFE020000-memory.dmp

Download

memory/2872-2-0x00007FFEFE010000-0x00007FFEFE020000-memory.dmp

Download