salatstealer | 7148fa81aab6e1d8bf61f81ca204616b5e28fb90a2c57d583ac9251da946b1ce

Resubmissions

04/08/2026, 06:18

260804-g2lwqaed3510

04/08/2026, 05:43

260804-gexppsw1bv10

Analysis

user interaction
yes
max time kernel
287s
max time network
290s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YapiCheck.exe
Size 3.4MB
Sample260804-gexppsw1bv
SHA256 7148fa81aab6e1d8bf61f81ca204616b5e28fb90a2c57d583ac9251da946b1ce
MD5 16ddd16237178c7b057856de76789335
SHA1 760c83e0ce429038c74b2a7da62713247178998e
SHA512 d857ff9a7a99963460f49ee5d86baae5ea2f13d91dc4d678eb135baa144e1c2c810e52adb6de2b2b3d200eb313a7dd80084fb44cfa098a8070ee2cc31adb24c5
SSDEEP 98304:56qfSnO5VFo61XSTI7+Ma8IJ+flbdXKT:56qkWro6lSk6M4JyN
TLSH
T1A2F5338369F1EC76FE30603688955665127EB035DECEAD3DF05988CA8712BC09B36E43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery salatstealer persistence spyware stealer upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 31 IoCs

resource	yara_rule
behavioral1/memory/4860-1-0x0000000000070000-0x0000000000CC4000-memory.dmp	family_salatstealer
behavioral1/memory/4860-27-0x0000000000070000-0x0000000000CC4000-memory.dmp	family_salatstealer
behavioral1/memory/4860-40-0x0000000000070000-0x0000000000CC4000-memory.dmp	family_salatstealer
behavioral1/memory/248-42-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-43-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-44-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-52-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-83-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-409-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-996-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/5428-1008-0x0000000000D20000-0x0000000001974000-memory.dmp	family_salatstealer
behavioral1/memory/248-1139-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-1294-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-1335-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-1424-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-1425-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-1426-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-1433-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/4528-1458-0x0000000000890000-0x00000000014E4000-memory.dmp	family_salatstealer
behavioral1/memory/1496-1457-0x0000000000B90000-0x00000000017E4000-memory.dmp	family_salatstealer
behavioral1/memory/3808-1459-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/2540-1461-0x0000000000910000-0x0000000001564000-memory.dmp	family_salatstealer
behavioral1/memory/248-1503-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-1985-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/files/0x000300000001b938-2007.dat	family_salatstealer
behavioral1/memory/248-2115-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-2198-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-2212-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-2232-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-2260-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer
behavioral1/memory/248-2281-0x0000000000330000-0x0000000000F84000-memory.dmp	family_salatstealer

Executes dropped EXE 7 IoCs

pid	Process
248	spoolsv.exe
1364	Un_A.exe
5428	spoolsv.exe
1496	dwm.exe
3808	spoolsv.exe
2540	WmiPrvSE.exe
4528	Taskmgr.exe

Loads dropped DLL 1 IoCs

pid	Process
1364	Un_A.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4860-0-0x0000000000070000-0x0000000000CC4000-memory.dmp	upx
behavioral1/memory/4860-1-0x0000000000070000-0x0000000000CC4000-memory.dmp	upx
behavioral1/memory/4860-27-0x0000000000070000-0x0000000000CC4000-memory.dmp	upx
behavioral1/files/0x000c00000001c54a-32.dat	upx
behavioral1/memory/4860-40-0x0000000000070000-0x0000000000CC4000-memory.dmp	upx
behavioral1/memory/248-41-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-42-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-43-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-44-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-52-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-83-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-409-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-996-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/5428-1006-0x0000000000D20000-0x0000000001974000-memory.dmp	upx
behavioral1/memory/5428-1008-0x0000000000D20000-0x0000000001974000-memory.dmp	upx
behavioral1/memory/248-1139-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-1294-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-1335-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-1424-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-1425-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-1426-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/6100-1427-0x0000000000400000-0x000000000066C000-memory.dmp	upx
behavioral1/memory/6100-1431-0x0000000000400000-0x000000000066C000-memory.dmp	upx
behavioral1/memory/248-1433-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/1496-1434-0x0000000000B90000-0x00000000017E4000-memory.dmp	upx
behavioral1/memory/3808-1441-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/4528-1443-0x0000000000890000-0x00000000014E4000-memory.dmp	upx
behavioral1/memory/2540-1444-0x0000000000910000-0x0000000001564000-memory.dmp	upx
behavioral1/memory/4528-1458-0x0000000000890000-0x00000000014E4000-memory.dmp	upx
behavioral1/memory/1496-1457-0x0000000000B90000-0x00000000017E4000-memory.dmp	upx
behavioral1/memory/3808-1459-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/2540-1461-0x0000000000910000-0x0000000001564000-memory.dmp	upx
behavioral1/memory/248-1503-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-1985-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-2115-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-2198-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-2212-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-2232-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-2260-0x0000000000330000-0x0000000000F84000-memory.dmp	upx
behavioral1/memory/248-2281-0x0000000000330000-0x0000000000F84000-memory.dmp	upx

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Reference Assemblies\73a534ba-5bfd-6c90-81ed-80f64b3bba5b	YapiCheck.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\dwm.exe	YapiCheck.exe
File opened for modification	C:\Program Files (x86)\Microsoft\73a534ba-5bfd-6c90-81ed-80f64b3bba5b	YapiCheck.exe
File opened for modification	C:\Program Files (x86)\Microsoft\WmiPrvSE.exe	YapiCheck.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\73a534ba-5bfd-6c90-81ed-80f64b3bba5b	YapiCheck.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\spoolsv.exe	YapiCheck.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe	spoolsv.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiPrvSE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un_A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YapiCheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1228	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 39 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302960534521136"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\upx-5.2.0-win64.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
4860	YapiCheck.exe
4860	YapiCheck.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
4860	YapiCheck.exe
4860	YapiCheck.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2556	taskmgr.exe
248	spoolsv.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe
1900	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	taskmgr.exe
Token: SeSystemProfilePrivilege	2556	taskmgr.exe
Token: SeCreateGlobalPrivilege	2556	taskmgr.exe
Token: SeDebugPrivilege	4468	firefox.exe
Token: SeDebugPrivilege	4468	firefox.exe
Token: SeDebugPrivilege	248	spoolsv.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeIncreaseQuotaPrivilege	2380	powershell.exe
Token: SeSecurityPrivilege	2380	powershell.exe
Token: SeTakeOwnershipPrivilege	2380	powershell.exe
Token: SeLoadDriverPrivilege	2380	powershell.exe
Token: SeSystemProfilePrivilege	2380	powershell.exe
Token: SeSystemtimePrivilege	2380	powershell.exe
Token: SeProfSingleProcessPrivilege	2380	powershell.exe
Token: SeIncBasePriorityPrivilege	2380	powershell.exe
Token: SeCreatePagefilePrivilege	2380	powershell.exe
Token: SeBackupPrivilege	2380	powershell.exe
Token: SeRestorePrivilege	2380	powershell.exe
Token: SeShutdownPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeSystemEnvironmentPrivilege	2380	powershell.exe
Token: SeRemoteShutdownPrivilege	2380	powershell.exe
Token: SeUndockPrivilege	2380	powershell.exe
Token: SeManageVolumePrivilege	2380	powershell.exe
Token: 33	2380	powershell.exe
Token: 34	2380	powershell.exe
Token: 35	2380	powershell.exe
Token: 36	2380	powershell.exe
Token: SeIncreaseQuotaPrivilege	2380	powershell.exe
Token: SeSecurityPrivilege	2380	powershell.exe
Token: SeTakeOwnershipPrivilege	2380	powershell.exe
Token: SeLoadDriverPrivilege	2380	powershell.exe
Token: SeSystemProfilePrivilege	2380	powershell.exe
Token: SeSystemtimePrivilege	2380	powershell.exe
Token: SeProfSingleProcessPrivilege	2380	powershell.exe
Token: SeIncBasePriorityPrivilege	2380	powershell.exe
Token: SeCreatePagefilePrivilege	2380	powershell.exe
Token: SeBackupPrivilege	2380	powershell.exe
Token: SeRestorePrivilege	2380	powershell.exe
Token: SeShutdownPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeSystemEnvironmentPrivilege	2380	powershell.exe
Token: SeRemoteShutdownPrivilege	2380	powershell.exe
Token: SeUndockPrivilege	2380	powershell.exe
Token: SeManageVolumePrivilege	2380	powershell.exe
Token: 33	2380	powershell.exe
Token: 34	2380	powershell.exe
Token: 35	2380	powershell.exe
Token: 36	2380	powershell.exe
Token: SeIncreaseQuotaPrivilege	2380	powershell.exe
Token: SeSecurityPrivilege	2380	powershell.exe
Token: SeTakeOwnershipPrivilege	2380	powershell.exe
Token: SeLoadDriverPrivilege	2380	powershell.exe
Token: SeSystemProfilePrivilege	2380	powershell.exe
Token: SeSystemtimePrivilege	2380	powershell.exe
Token: SeProfSingleProcessPrivilege	2380	powershell.exe
Token: SeIncBasePriorityPrivilege	2380	powershell.exe
Token: SeCreatePagefilePrivilege	2380	powershell.exe
Token: SeBackupPrivilege	2380	powershell.exe
Token: SeRestorePrivilege	2380	powershell.exe
Token: SeShutdownPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeSystemEnvironmentPrivilege	2380	powershell.exe
Token: SeRemoteShutdownPrivilege	2380	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2556	taskmgr.exe
2556	taskmgr.exe
2556	taskmgr.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe
4468	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 248	4860	YapiCheck.exe	91
PID 5484 wrote to memory of 1364	5484	Uninstall.exe	95
PID 4348 wrote to memory of 4468	4348	firefox.exe	99
PID 4348 wrote to memory of 4468	4348	firefox.exe	99
PID 4468 wrote to memory of 5548	4468	firefox.exe	100
PID 4468 wrote to memory of 5548	4468	firefox.exe	100
PID 4468 wrote to memory of 5548	4468	firefox.exe	100
PID 4468 wrote to memory of 4352	4468	firefox.exe	101
PID 4468 wrote to memory of 4352	4468	firefox.exe	101
PID 4468 wrote to memory of 4352	4468	firefox.exe	101
PID 4468 wrote to memory of 4352	4468	firefox.exe	101
PID 4468 wrote to memory of 108	4468	firefox.exe	102
PID 4468 wrote to memory of 108	4468	firefox.exe	102
PID 4468 wrote to memory of 108	4468	firefox.exe	102
PID 4468 wrote to memory of 108	4468	firefox.exe	102
PID 4468 wrote to memory of 408	4468	firefox.exe	103
PID 4468 wrote to memory of 408	4468	firefox.exe	103
PID 4468 wrote to memory of 408	4468	firefox.exe	103
PID 4468 wrote to memory of 2384	4468	firefox.exe	104
PID 4468 wrote to memory of 2384	4468	firefox.exe	104
PID 4468 wrote to memory of 2384	4468	firefox.exe	104
PID 4468 wrote to memory of 2384	4468	firefox.exe	104
PID 4468 wrote to memory of 6180	4468	firefox.exe	105
PID 4468 wrote to memory of 6180	4468	firefox.exe	105
PID 4468 wrote to memory of 6180	4468	firefox.exe	105
PID 4468 wrote to memory of 6180	4468	firefox.exe	105
PID 4468 wrote to memory of 6516	4468	firefox.exe	106
PID 4468 wrote to memory of 6516	4468	firefox.exe	106
PID 4468 wrote to memory of 6516	4468	firefox.exe	106
PID 4468 wrote to memory of 6516	4468	firefox.exe	106
PID 4468 wrote to memory of 6524	4468	firefox.exe	107
PID 4468 wrote to memory of 6524	4468	firefox.exe	107
PID 4468 wrote to memory of 6524	4468	firefox.exe	107
PID 4468 wrote to memory of 6524	4468	firefox.exe	107
PID 4468 wrote to memory of 6536	4468	firefox.exe	108
PID 4468 wrote to memory of 6536	4468	firefox.exe	108
PID 4468 wrote to memory of 6536	4468	firefox.exe	108
PID 4468 wrote to memory of 6536	4468	firefox.exe	108
PID 4468 wrote to memory of 2296	4468	firefox.exe	109
PID 4468 wrote to memory of 2296	4468	firefox.exe	109
PID 4468 wrote to memory of 2296	4468	firefox.exe	109
PID 4468 wrote to memory of 2296	4468	firefox.exe	109
PID 4468 wrote to memory of 2360	4468	firefox.exe	110
PID 4468 wrote to memory of 2360	4468	firefox.exe	110
PID 4468 wrote to memory of 2360	4468	firefox.exe	110
PID 4468 wrote to memory of 2360	4468	firefox.exe	110
PID 4468 wrote to memory of 4728	4468	firefox.exe	112
PID 4468 wrote to memory of 4728	4468	firefox.exe	112
PID 4468 wrote to memory of 4728	4468	firefox.exe	112
PID 4468 wrote to memory of 4728	4468	firefox.exe	112
PID 4468 wrote to memory of 3796	4468	firefox.exe	113
PID 4468 wrote to memory of 3796	4468	firefox.exe	113
PID 4468 wrote to memory of 3796	4468	firefox.exe	113
PID 4468 wrote to memory of 3796	4468	firefox.exe	113
PID 248 wrote to memory of 2380	248	spoolsv.exe	115
PID 248 wrote to memory of 5428	248	spoolsv.exe	117
PID 4468 wrote to memory of 2116	4468	firefox.exe	119
PID 4468 wrote to memory of 2116	4468	firefox.exe	119
PID 4468 wrote to memory of 2116	4468	firefox.exe	119
PID 4468 wrote to memory of 2116	4468	firefox.exe	119
PID 4468 wrote to memory of 1320	4468	firefox.exe	121
PID 4468 wrote to memory of 1320	4468	firefox.exe	121
PID 4468 wrote to memory of 1320	4468	firefox.exe	121
PID 4468 wrote to memory of 1320	4468	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\YapiCheck.exe
"C:\Users\Admin\AppData\Local\Temp\YapiCheck.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Mozilla Maintenance Service\spoolsv.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5428

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3844

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files (x86)\Mozilla Maintenance Service\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27098 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {16bfe148-a89f-4d06-85b4-8ad1e8eab82d} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27134 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {81f10b86-8a00-41c6-917e-142958fdc489} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3748 -prefsLen 27274 -prefMapHandle 3752 -prefMapSize 270279 -jsInitHandle 3756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3764 -initialChannelId {8fde350b-c9b7-4f53-a8a9-991cf81b56be} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3792 -prefsLen 27274 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 4016 -initialChannelId {f291fac5-26bb-4792-9065-6d231ce9f478} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 34773 -prefMapHandle 2840 -prefMapSize 270279 -jsInitHandle 4200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2588 -initialChannelId {37733b8b-bbed-4b9d-8d86-624ee0985d65} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35089 -prefMapHandle 5044 -prefMapSize 270279 -ipcHandle 5072 -initialChannelId {eea64aa0-b2df-40d3-83ae-16162236346c} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 33031 -prefMapHandle 5740 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3180 -initialChannelId {3675559c-eabe-4665-bdd4-a6c57171eade} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 33031 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1620 -initialChannelId {7a670700-acda-4167-8065-419f3990de42} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6128 -prefsLen 33031 -prefMapHandle 6132 -prefMapSize 270279 -jsInitHandle 6136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6100 -initialChannelId {d2cf5999-4068-45ad-b46c-7a0f7a5db7cc} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6560 -prefsLen 33071 -prefMapHandle 6528 -prefMapSize 270279 -jsInitHandle 6532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6584 -initialChannelId {20393066-0b1e-42e6-95fc-ea4c12ecb289} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6596 -prefsLen 33071 -prefMapHandle 6256 -prefMapSize 270279 -jsInitHandle 6588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6284 -initialChannelId {12b41673-b908-430a-91f4-94db2a1476bf} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:2360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6588 -prefsLen 33712 -prefMapHandle 2996 -prefMapSize 270279 -jsInitHandle 6256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6812 -initialChannelId {86d65146-e20f-43ad-a229-117c9330138a} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4728 -prefsLen 34191 -prefMapHandle 4732 -prefMapSize 270279 -jsInitHandle 4588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {fc96c71a-bbb7-4cec-a864-e94b85f9b591} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:3796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7344 -prefsLen 36885 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 7460 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7060 -initialChannelId {9ccdffaf-d79d-4c63-bbd7-e9b91fdb6176} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 36885 -prefMapHandle 6392 -prefMapSize 270279 -jsInitHandle 7344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {370bd163-1bb6-409e-bb8d-d1c262824a77} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6024 -prefsLen 36885 -prefMapHandle 2992 -prefMapSize 270279 -jsInitHandle 6576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6600 -initialChannelId {1aaeaa65-5077-41df-bc19-617c38a7bd98} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:6696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6284 -prefsLen 36885 -prefMapHandle 1552 -prefMapSize 270279 -jsInitHandle 6024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6564 -initialChannelId {88e9e46d-6e53-43ae-aa5a-81701cea5363} -parentPid 4468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4508

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5624
- C:\Users\Admin\Desktop\upx.exe
  upx.exe -d spoolsv.exe
  2⤵
  PID:6100

C:\Program Files (x86)\Reference Assemblies\dwm.exe
"C:\Program Files (x86)\Reference Assemblies\dwm.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496

C:\Program Files (x86)\Mozilla Maintenance Service\spoolsv.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\spoolsv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3808

C:\Program Files (x86)\Microsoft\WmiPrvSE.exe
"C:\Program Files (x86)\Microsoft\WmiPrvSE.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2540

C:\Users\Admin\AppData\Local\Packages\Taskmgr.exe
"C:\Users\Admin\AppData\Local\Packages\Taskmgr.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff22cfc728,0x7fff22cfc734,0x7fff22cfc740
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,12383535733590809623,7949137807359434360,262144 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,17733204833240394980,12397021016010258968,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,4798428797301498474,3916463779453561171,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:13
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,1795127428543693188,8791977942481353594,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:7128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,9918812862019927695,5812911619570934347,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,11820268740178413484,1840625979395440134,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,2692673778856571791,3158339569577071205,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:6956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5384,i,8768537852433348901,16190527427756988022,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,15761680496593717892,14456433573154646088,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3556,i,8923283966830035737,11078100488177710753,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:7060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3924,i,4108416840701790050,18304196076631658355,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3540,i,7912012396873157326,15965093303645891313,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
  2⤵
  PID:6172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5588,i,9448936108891291777,3494905541482971449,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5576,i,11251954226263540817,7032005874574488647,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:6900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6516,i,13322169437161134089,3435229630573992194,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:6928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5648,i,12048612628512785084,3923525727178677071,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5696,i,12356856111340299441,1286115416616501438,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:7096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6508,i,228647755768079367,9025847122545492304,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:6352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,1207692809254946036,12177290801577423720,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,5594737779938096668,14335889005699395261,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5984,i,1795721255690591961,11247747334010164544,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:6520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6804,i,3481809061085995422,1234582617982826847,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:9
  2⤵
  PID:7048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6716,i,18033165932846939283,1623695613389164410,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:6784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6664,i,6296934403494924902,10378368014434150836,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6856,i,10364775401326330602,4131320779710695291,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4716,i,15196544136927401117,17088806906127466391,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
  2⤵
  PID:6192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6764,i,10147073334038140967,11549765613549105108,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,6215098855518751248,10670833091347126470,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,14712399888457202704,14076352463138120408,524288 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:6464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6576,i,13726746311339141965,2058000824379818430,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6804,i,2856025831135264311,14810524540317765887,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6340,i,1089989979468849553,17915781195411425911,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6680,i,3023872410728605679,6956065420819746076,2097152 --field-trial-handle=1980,i,7789747687988202094,450815371339472930,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:6652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 41KB
SHA256 d5025e5c9b4fa99ec7204c91f054c7145fccdb24d8d3257d1be108bf9702bbe6
MD5 edd2b6655252b4e6d5c5cc775b4ceff5
SHA1 ee259ece556da0aa449bdacdf6dbd2393ac0db56
SHA512 20faf34e5e2bca8fde2f561af1dde58c61bbf550fb87fe74175d17de24d34e923dad864ca1011939f2f70600d357047a0b4781eca165515ff76ac1945765e4f4
SSDEEP 768:BEU/qZdqVxGDRsdtKBVYEe4h42aO0FzDzEUF2TUvWH36CvOORk2akYSKb3Z:BN/qZdqVxwI7EZh4/FfYUFI2WX6+k2Fa
TLSH
T1351302117C41D685779FB6BA4A75296932F4F72A28D18C54DC26107D0FADCF38AD0BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 51KB
SHA256 5ac2113c905417b069a251b16dbdb01d43d80e0513ddd2f86e004bb8264ceca1
MD5 16f4ae504fd18feec6d175f276b1ef24
SHA1 230f32b0966cb33754cbeab0bed23510d4d27a00
SHA512 9fd2e0f730d0d6960915f44f431a4ff68c493b6ace903bd9548b403d970adc3016664f493744d8625916ae7d5e4f2d98e7ad071687873f36538912f953e39eaa
SSDEEP 768:dwNWNTb/0/Y9WpibJioScAHi3N+ZNcRZTc5UPmHSwD9UL5ewjsai0BEVCXHGSZvH:dDTbwWWgOcAHrNscGPm9hX0SVCCO
TLSH
T1F33302B5F3116692DA9BEE06A4251352CF37A4F5C2145B6E880DC14BBB16F8273DB4F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1653efeb6b15c86c89a4fe4e301f26e90e3316b403bb6d2c9b0df51093fdc024
MD5 69845be85a7c5b747a97ea3511bbf862
SHA1 ea837a621020eb12ec14da13829018c0af998933
SHA512 811aee75ab1ad6c1b5a1077b1aced6a398223bcb681de71d56ad24d6f1d8681bf0581cfb7471bfc63c707b01fa9dad277a78354da91d79674f6ea9fa62f373d0
TLSH
T1C131821631C86A14CF11B67594E17F512D331E8D32E32FD3543876F9D04BBE8602A89A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 df21a55a26f294fd0d7e36db91cab39dafe4b6a1aebf451a85b7c556dd27a898
MD5 1085d4fa2b38bb1f2ab5a1725171842b
SHA1 121c5b6c41103467c554af98161b2ee3cc604b6e
SHA512 1b66d62413473496763a8c81f77307e20c7078b8e7da61116de3df245b9236d7567fb58c4fa203aa0f13a775c734a58b764724639e4b9bb87c96823f7a0c90af
SSDEEP 192:DNPeK/UQvZwDyx92oE3cZ57p1AqhVeioPShJn8V+HsZO/ln:DNPeK/UQvZwDyn2oE3cZ57p1AqhVeioI
TLSH
T150127CB3C3D8862DC81162F5AF257E1BCD2D092452683D77C9D9FE4A63E6872E34064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a340a78e791fb4badb22dc350a504a0dd104393555fa2af97656ede3f2ede4c3
MD5 1ccfa609fba1de642cc62f54bba7321b
SHA1 37e99be4ff3e86bf5cedbf72ee056d85320de9c1
SHA512 3d4aff6b7443daa5d22e49d50b1f95b37bc8bc67f0e6bc7d39f43fb2007a58025cf07d2d4c39e11444f4edc3f87d9a267d6f403f634b339a1233d088574c5a0e
SSDEEP 192:DmR5rbkoau7C/1TUgRFv7+Ar5PRpelM5wvdE5t5Tl5Z5h9pHsb+WNF5h5H9MB5/x:6RRgKKX7XhTwyuaREUEjE
TLSH
T1FF52C92BA8107A7B5DDBD219F999B757E7F1102161942E84EBFCCA2C10E79CC6327013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 16e9958b8729bd4c041c3597be021ae8a18edb879782c21dd36e743231d12d37
MD5 b4bee441225722ab5fb52ddd1594f190
SHA1 846d72448be724624f398480daf45f8722eac3f8
SHA512 259b802db6e8237429b0aca15c245c7cfb1ae0f27e39c81b090aa1dc93a390b2c72347758644c77c8e6e867cc958098db9a1a2c7602bf13c633983d3627424aa
SSDEEP 192:DAR5rbnoau7C/kUgDFv7+TAPRp2/5t5a9pHsb+WNn5d9+45/9k22MbdXEkweoK9w:MRRLK/B3XRTwg926cje
TLSH
T10042C62FAD11B93B5DDBC219F9AA7753E7F6102161942E84EAFC892C10E79CC6327407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 81b7000d5cbcd1539200ad42c46550bbcd8a3ea70b8d54c5868da8f0f8513a20
MD5 99dded9d9084f505009d075a2108b810
SHA1 fee14c62ccc088456e0b5fb80c56ff661901ac82
SHA512 296ec5deea4b266ca1e2d097cfe023fd34820a2b1cf57b31b6eb6b71c6748c3e0c60980610952469094181f0acc1d995965b1b92abc7ff05730edafb9f629bb2
SSDEEP 192:DAR5rbkoau7C/1FUgrFv7+TAPRp2M5wvdE5t5C5h9pHsb+WNF5h5d9+45/9k05W6:MRRgKE53XSTwO9aeggjE
TLSH
T19942C72BA810793B9DDBD219F9A97757E7F2102161942E84EBFCC92C10E7ACC6327407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1f0942595e81581ee4427ea2d19777a0464a2fa174c0e9f1cf4f284047c0b34a
MD5 ef7251d92045b963142f05db55d27991
SHA1 744e8e99f30f33a89900564c43bdd0f3bb99caa4
SHA512 dfa98035a5594bacf2e0460ceb2d000c1d71c2b4ebd0b4b3e524e70f1998a3be8e64cc46930cf6c4b3205f357f67e16acc9d6204005286133ec21931f5b7df31
SSDEEP 192:DAR5rbFoau7C/1FUgbFv7+TAPRp2M5wvdE5t5C5h9pHsb+WNF5h5d9+45/9k054S:MRRZKEp3XSTwO9121cje
TLSH
T17242C92BA950793B5DDBC219F9A97757E7F2102161942E84EBFCC92C10E7ACC6327407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 666001f41374ea30499285c38acefafc0ea49d073a9d7ef6a306241b381073ec
MD5 20100e51799352f3c81625c46b788b95
SHA1 5ff9311192e7ddec91fe09fb0d421251f0f4ff24
SHA512 bdc278939aaaf95fb6c6c2d59106f4fb64151872e6447ebb99ed73f0c57078d747eba2d79147feaeae4e966a0eeaefbb8658af2b69441e7a376977e6083129b7
SSDEEP 192:DmR5rbkoau7C/1FUgRFv7+AAPRp2M5wvdE5t5C5h9pHsb+WNF5h5H9MB5/9k05Ri:6RRgKEXgXSTwyuREogjE
TLSH
T11542C82BA910797B5DDBD219F9A97757E7F2102161942E84EBFCCA2C10E7ACC6327003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 32449bf1ca52e6c5bf0967e0a754a74c94b8d612807a58d80d82fab70d990b4b
MD5 9441b329d59d14c12f74ad3947246bcd
SHA1 b2413c568ae75ee30971c426e842e4b34379a2ec
SHA512 62752acf42449ca64c33f4c33bcffff3032a91a8db1ecf6610d0f3a4dad8d2900cd77b19d55b6597f0a4d893abb7d4013af61f6b48b4c983132bb6a6a8eef9e5
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKN98n50i4b+w:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLty
TLSH
T1F632D827A48E9E7F4FD8E51CDC577F4BACB502977278082497FB9C0403A978E124A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 8eb67237279a1cc87b99f2b0c64a1420167d6015cccceb28499045f4a8d6d499
MD5 d511f68958fb1abf11d861834da1ea33
SHA1 487976c6eb409e9f8c1f383fa276196763f227c1
SHA512 7a2266d306b188703a7d0d27fbd576242bdf9e678d43b5d05f55a316c227769fb09c09b460754340d31814413683feef403a2a79addd1eef06a01a28e97f2a9b
TLSH
T138B01214C2476D60CC014670210A218932808F3584011A4287D0F6EEC8570E00315140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 87059d30c436abeb5ec1f207e2c0f6c9c7a099a8ed7f6906ce55e2bb2e21c6de
MD5 44be9eaa851871adf4e452308704fa52
SHA1 8ce5748aff6eee60a15359bf077874430bd9ef70
SHA512 4cce868bb1bc66e43bb0c2c5812be7384f5bf0db73c3ae2d814279cbe337ecbea1e0af744ce7455dceb09283cd40bc36610c2f700dd05451011312988ebfd9f3
TLSH
T13DA0021241C11C21DD1682B0B1E2254667918C1876A1730764D60495C8DF2D54205214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb50f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5cb50f.TMP
Size 48B
SHA256 bd23bc315b52cf61dd2f092675f091e278ce6e70e406bce03f09b18a34472a47
MD5 47bee0da3f92f3180daa24c976731c90
SHA1 68189c8c3ee65930d5dcb0f7f7b7da642dfe3a61
SHA512 60b81d33b2683f261788be554367cc06ced02e2ccbcd9eb05df0748de6de09da54788d0c9a3d1cbaf20f0c7cd1449b8435124d939b9cff096f1f8866e7f4081b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 00693c01aac3078ba888f12b823ba9a24ebc648ea82796327196e083fed1233c
MD5 82c68d4341085bb47ed4bbe79424511b
SHA1 4adce1e7cdb950e28ba9a170d629435720f4beb9
SHA512 c7f67ca97d6c0091cc9d728dca4ebbd028b376d3306740266480080df445a04fcc1f22765b14be80f1ac254c502ca73c2d9fe99a8ae3b1a5602837062f514105
SSDEEP 3072:bEllIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aW:sDKf9E9dD6zEYdO44ErW
TLSH
T10CC312B10CB41EF31AF74072BAFB704EBA10AED7910B526C86D296847843DAE3957C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 68782acd936ae15f3cc02331d2094405ff15fa9fea8b9766180554765fac03c0
MD5 fce7ca3b42667289a05f260ee57424e9
SHA1 e3237c80eee348d4c10256fda3627f1e472d807c
SHA512 843fad91af06c6afa70027b4ad10e53f64fe54e7d49eb61b3a5141e7f4a1deb3d2c89cb5104a30d044077da5f82dd0151cccfb3edce9b484e7adebfe42d44ccc
SSDEEP 3072:b2lllIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aW:CXDKf9E9dD6zEYdO44ErW
TLSH
T197C312B10CB41EF30EF74069B6BB704AAE90BFD7D10EA56C85D5A684A443CAE3C57853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3726c6f9d2a995b2654880e8bfa777340b74a1a62e9946349f89b6ffa5ae3aa4
MD5 03b70e463bdcca727996031b70d01496
SHA1 b11d95088534e133446c01497d700f9ef69e164c
SHA512 6c34845e615eae6203662ffe544b610b89ab0afb5b489f55ec0d07d4be3e2a9890a2b6025ff37dfcdb3600a28e38474a5d7a23dbda47d128b467faed82c02155
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok55FVD5OB6JGyvTNm6zjqk+PEhij:mC0Nr7OJRPrL9/EtDUD5T5u9Imgjqk+D
TLSH
T102A11972A47E9CB74AB38545F5563B07DFA4716B5A21BF44D9DD2B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 b39dc3f0bd17fe5340020ce37c782a481f250b6170cbf205c6badb97b65c7b86
MD5 40b3e7b4747eb68428b38dd2d5b5ce91
SHA1 ad882a92136eccabc98a20ca96da244f4bbcd469
SHA512 fcc20d6d603a24cf8ffbce6e064461ec6c39c740ddeb2704999a85f550861bc08f717d47f064db39234a191685e12753d41f74325150427006d46321e7b14a63
SSDEEP 3072:bGjllIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aW:K5DKf9E9dD6zEYdO44ErW
TLSH
T1CBC312B11CB41EF30EF74069B6BB304AADA0BFD7D20EA56C85D5A6846843CAD3C57853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 be61da693ef6198a459705164ea34775130414a5530964a2988104e9eb1f7a31
MD5 8022148a12d0b808d3d56bb943c823b3
SHA1 944227822dcb4b89eb36dd871ac4cdda53099052
SHA512 d3d4a9ba09f4691034679d759effee25fdbdfbfdfb7606c7bbd077e065d1b9d39804a61b021714cb63204b71bc61a998ef962aaf69970dc56d7e3eb868f83c20
SSDEEP 3072:6+llIT4Kf9fBiFdE0Pvwo1NDoRzUxuQmdex44EQk0aW:lDKf9E9dD6zEYdO44ErW
TLSH
T117C312B10CB41EF31AF74072BAFB704EBA10AED7910B526C86D296847843DAE3957C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 936421a62612894f8fb6863a55bb18976f6caaac2c536fcabf1a3f85d66c1e17
MD5 34ed5dfc44a7607e3900b6b22655b2d7
SHA1 95688188c8f5a6586d91d88663d4b89bb2829ecb
SHA512 907ac5f71daea31293e3dd036c31c0afc76b22ceda0834bc0beb9783208580e47ec69dede7d48e5ee19781022d410cab5c5a42254dc84fd7da5e3793cfd866e5
SSDEEP 384:HwCe7iO024YvDL84KKDL849B7SOEAd9KVRaAcP+AWRMAV5F:QqZYvDL8lKDL8CB7S/AmVAf+hRMG5F
TLSH
T12E729E3E9F013CAC1997D0E8C1B992D94C19B7A3CFE6806D21683D0DCB98969B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Taskmgr.exe

Path C:\Users\Admin\AppData\Local\Packages\Taskmgr.exe
Size 3.4MB
SHA256 7148fa81aab6e1d8bf61f81ca204616b5e28fb90a2c57d583ac9251da946b1ce
MD5 16ddd16237178c7b057856de76789335
SHA1 760c83e0ce429038c74b2a7da62713247178998e
SHA512 d857ff9a7a99963460f49ee5d86baae5ea2f13d91dc4d678eb135baa144e1c2c810e52adb6de2b2b3d200eb313a7dd80084fb44cfa098a8070ee2cc31adb24c5
SSDEEP 98304:56qfSnO5VFo61XSTI7+Ma8IJ+flbdXKT:56qkWro6lSk6M4JyN
TLSH
T1A2F5338369F1EC76FE30603688955665127EB035DECEAD3DF05988CA8712BC09B36E43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvF5F0.tmp\System.dll
Size 22KB
SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
MD5 b361682fa5e6a1906e754cfa08aa8d90
SHA1 c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA512 2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP 384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh
TLSH
T153A27C62C7605CF1FD629D3430E4AE2B6F79BB496B9084E397AAC0405B817C365FD287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1900_340193268\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Un_A.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
Size 100KB
SHA256 dfafeef721064c822faa278595e54b422df3cb14d3724db3cc984220bec052bf
MD5 104dc296ed2c53cc21585652c7fde10e
SHA1 4381d5622e904f4260141d4b6d9d48bab10d839d
SHA512 7ec6fd150d8a37530ba3a4692644f9e3e9a6673045a280bdcbfae48e378691b706d8fdbd073f8842c71e35a893f3b8d46fd41525753f624ef2914187ae9906a8
SSDEEP 3072:YNRCywDw1DiJku6UNRD5bCs57y4jem7y6tV:YT4DtOUjD5F57y4j9r
TLSH
T1FFA36C01BBE0C9A2F9F20B303C769B365F71BC265DA08B4B2350774DED72681D92A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 27KB
SHA256 3c46b35280b35979256183cbf8a2f6acdb7007c97bfc72416d39895b52cf45f9
MD5 66ea596639d42bac5fa7618724dcee2e
SHA1 0e9d03fe22e47e700a1d3ec269413337a305c5e7
SHA512 f912cfc909c6a8d312fdc6bf884010ec93b2b112f363912bbe945f39790b630a3c0aa3930c0da1396729d1eff5445eca7c7f9b5f5857c1d40cbe408e32ee44a9
SSDEEP 96:ZB4KI56ugUHyuZIEkGy4LOgIaWutM/pCGyx2IZlfzzBBiYkMIua3uvZYYpdG+QG1:2ZZpQf22gluY
TLSH
T19EC284F72B7574A2F5A28FB040ACB09CCC3312265599C5C4DA55E0E752C26ACE17FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\AlternateServices.bin
Size 10KB
SHA256 e2333e8417274314d90b04174f43410f53b4848fc059e545d330be6814ff539d
MD5 c909172d9d1d25fd2e83ee9da69c4508
SHA1 13ffcd426dafa2d5501c2153c40170233a1b67ff
SHA512 1f5074b8e4e3c25059552eae5f64a58a7f122c86e8b850d1ab23e67ecc33e76c67c089e6568d79a3cfe0da63e2eb5e005b8d38df7642e3504ce99b35b76adc61
SSDEEP 24:zuhMZWd9VvDD49xeVi9Bt0X916p8z9FXDE5q9F55A5Hp8L9lbD:QB3y+QMtVhR2I56+pt
TLSH
T1162283E76F72A4A2F0A2CFB4406D714CDC33132515AD9584E654E0F752C2AA9A13FBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\cookies.sqlite
Size 512KB
SHA256 19c0fce119f9806f3f41ae34a35ca141bd75c420e381754c48ee1b5623db96f0
MD5 27d8383f3dd7cad3e6d0ffa6532b2122
SHA1 96944dd83913ce8be3ac815455a6e6a00aa6fdd0
SHA512 045fee10ae8979f400256e320f7c638083485bb486e56941c0d7019435e55ed7727952fab469fd96d1fcfca4aed8e5ea3c9c929f2683a778a931182ab5b06496
SSDEEP 24:DQnS232mNVpP965RayKN0MG/lto/PRuObJJn/aKq8X2sMgeoUSoOhE6aBFE/DZZF:DQnS6rh9WTPyPRuGJRHbNdnoOhZg+/
TLSH
T1B6B46093BBA412A1CCC24AB39D20929D5E3D573BC857CAE6A818B0B32DC5907D530CF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.bin
Size 118KB
SHA256 375a356d9439217717df896868321a6ef179b023242e853bb4bccde7ea12b7bf
MD5 95ade4d1075c5917b9a2a64b609f0b65
SHA1 007b2c889d0926b061b5450756d4aca7f68ed655
SHA512 2bfeb4ba8634fea3de20790cd5ce06366ca7331b0c064dfee80edb5e013e445f28f318cdd575fbdebd90a3d9b632ef73a472ada37e1c6155b4bce0770c49e596
SSDEEP 3072:Qq08bZzC40+deJgvmfBPaE7oUv4Kj4sDJ7to06eWIAC:QqbbZzC40+deJgvmfBPaE7oUv4Kj4sDV
TLSH
T1E6C3CED0DB1B407BEC2485BF7495573C2635F4214A59AB0B3AAC04761DCF3BF2D0AA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b98421d5222eea49c23fdf531bb5be0f781a7fb25910fb7e510fe710e2bf68da
MD5 12e263b4436d8922bf27c1a797720605
SHA1 0b94db9dd2cae1c1f57d8d00d50ec9b5a0ae1251
SHA512 5c9271908355e3e24e946cda0efde413881e500285f56e3be012a02093f992c20ee99fb162323f326436c4c7bf7dca5c3031716e6f0665516cb7312da0b244f6
SSDEEP 192:PtOv5zbo7NZCQyjjMJaqj1d66JoztdzgCl6mc0d:PCbopZCQyjJqBd66Joz/zgC1j
TLSH
T12EE10FA4E628463FC408437BCCA61F440F35399A9C4E3F1935AC651C2D5B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 7054060931df30ef030fa6173a87d14228eaefdca967f9d19f50e87a346a7d51
MD5 d809b23336805da9755509b564b03a25
SHA1 837a4fdcd09dde2a01378546344a598a6708da7c
SHA512 ba340f7e1cc5b7b4fd8cf1367472309999855dec0dac1a3aea50b915138284163edce13f7c34c1e8753ea5ca0aee15fbbf4db55f880e9b22d07d5648bd3f9c63
SSDEEP 384:LVCidxFS++dnVP5LGcm+uExOi3KPSGugbibxsEUqqd66Joz/zgC1jDCboVCQyjC:LV9FB0nHLGcm+u7GKPSGugbibDU01EUZ
TLSH
T14AD20144FB2A513FD41952BBDCA50B002F79B88A581A2F573A4C646C6C872DC7D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 1KB
SHA256 412e6edd95b11b1c2a5d50ee8ca03677f1f01c0e18cff09061c61389547a8360
MD5 24eed1938af854f8425248b56a62df0f
SHA1 aa6f5d53459041afb6361a1daca825bde1b57326
SHA512 ea2862fa17b296c16ab807235a0c90d930a29901b72ae5c89856e0f6a5757bc6345f6748629b862147eb2cc36aaab7505da608c8eb8e50fe81b3979a9f5b24c9
TLSH
T14421455C7EB84D2A9DCAE39C7445128E93914E0214871C439D13FF8DDE81AD9336A4BD
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
Size 4KB
SHA256 881d80119300aab5064a8d1d9c0ff6b4a00e2b6b78baf11df002b42a695da1e1
MD5 357047e885c10e46024b14218063f494
SHA1 8ed6c47c705ed618596ec0b7376ec3144e6a8d9a
SHA512 ba47348f6e2c78c8e6de0ea5524f433e1e690bfc8426c0f8a2fe9c1cfe96bc50f778d3ffa4f5b55929e0aea4a6c8e11a85795f6c4818ebeda895e8773f9a3c32
SSDEEP 96:c84j9cfNmokvt4pukd1ydImjz54iH2S0j:c829GyvtA10IbiHWj
TLSH
T1E5A12D1D7AA90CBE6ECBD39CB841028D87D98B0295CB1C435C97FE49CD86A99325F42D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1877e922-2fc9-4afb-a070-a9a31f351019

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\1877e922-2fc9-4afb-a070-a9a31f351019
Size 883B
SHA256 a11b0bde8512214cad6176ee6cdb78729e5f65c19bc5bc8e21e954f9585ffcc2
MD5 8b34b3d0e6a8ffa7f0e8b3187362f437
SHA1 d310e05cbcec4f3941197997956283b624361dba
SHA512 d0d0f8513269e92086a570d68ced2c8a636462a13a16a041a0d53c8d50ffef867ec3b8001162709de2c4a39d1e0ff55c5b70b5fe077d1c0ad590920e980bcdb2
TLSH
T11A1123D29730BAB2CC7C824F89963B429BE4A81384CA50143DB15E184E7E60FA7E9747
MD5 SHA1 SHA512 TLSH

Submit Download

365fe2a9-f138-44de-af45-2e14b3cbde3f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\365fe2a9-f138-44de-af45-2e14b3cbde3f
Size 235B
SHA256 1555db31834ec25d46afb0df565200548d3bbddc486298ad1114f71efd8d700f
MD5 711dffc0dd94f4bc25872661f3fabc6a
SHA1 6097f1a35bc4fdc5f4182d7c3e7398104b5034b8
SHA512 738987abe48236ba515ed15158142a52dd334e58c3344f4d983d63893f8313f582677f68ac2dca64103aca86dc8440d6f9b6e789b2c83765a58fd1079f7d2e3c
TLSH
T19CD0A78414A8676D5C140F1BB0A469D630954C3355A89811DA914774EAB9DC971E192E
MD5 SHA1 SHA512 TLSH

Submit Download

40e5d04c-73d8-434f-b23f-95a038a0d3d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\40e5d04c-73d8-434f-b23f-95a038a0d3d7
Size 15KB
SHA256 3edf1adc17eea41659ccec7ed5eb6a701aea9052d4f9272c38ed9e2b521e782c
MD5 e6d8d3d2b97085349c2c32c076c94bdc
SHA1 7a61c9cd0e502f42746ab84af7d2aa20a42504d4
SHA512 17936e293b5978fda5a095120816d38847f7a18a05f88ad1be088bbcf2b27314769d6735efb886e3dc47a9f9b8bcdf1e9f29e6c273b9b5d430bbdcae3eb91d65
SSDEEP 192:HNCJ1rzxqKIUgJELadkJuumpXqNal34xjNHLnvpuWbgzLasIBMn21LgDcG:tA1rlqKIUAGjlhusgJIw2gDB
TLSH
T1A762EA566420597B8551E76CD8EC7FC3F6F508CB8C029FCD9BE47D086AEA09E1127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4df51f22-5c45-4242-86af-b2f49f7ab633

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\4df51f22-5c45-4242-86af-b2f49f7ab633
Size 2KB
SHA256 f521df9e9a34bfe73701ec71173d2b41b66b1a3293da6d4f546c86fc9a6b7357
MD5 ed66f55c52127b5b5f25eab73f2a2c5e
SHA1 9fd7eab3b399b227c362193b5d919a3a79b80e85
SHA512 d1539104b2a7fd4bdfe682bda650db6d3afcedde09e9c4a90cc1461e7a5ca1228e9bbd13e6d28ab16cb0ed147fae61f959d7761ec44ed176333afe3e35efd23c
TLSH
T1F24153AC35B85C369C9EE54D808232CE93708A5314C628833E51DF0C8E9679E33AA51B
MD5 SHA1 SHA512 TLSH

Submit Download

6eadb20c-b9bf-45b7-ae73-5ef7e5ff6890

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\6eadb20c-b9bf-45b7-ae73-5ef7e5ff6890
Size 25KB
SHA256 26a6ef326a09be449e30c1de634589df0d95d3e64c8ce73d4fdffb56b06f0a94
MD5 d3213b78c6e2e806a0e1f6174338c42f
SHA1 89b7431411ad7cc88c94ad4a4959b34105bcb65e
SHA512 c76d9f3fb407d1b5ad8d7ecabed29834da2c51ca95fdc874508d2b7175df5d67a2aca923109a2d2c17320e4930782ac198cb77753fcdc081c6fdca5669cfec16
SSDEEP 768:4seWba/UT/i/HFgGyj2GjPPmKaGhX8XYa7DPk93cS8DJTHepVEYvt+zEkDtdelQN:T2/hvMu46l/P7h+/Xy
TLSH
T1F7C2D9FDCE1240473E65E52EF2E5ADAB2057193209CDC7CD69FD483A26C69BB1227318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

993588cf-72de-4bbb-82d4-f79e3d0057ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\993588cf-72de-4bbb-82d4-f79e3d0057ba
Size 886B
SHA256 9bf34758ead3889def8b931446c0503b042c53e29fc9f169f4632aeff94bff6c
MD5 8820800ed34f051226c4eb21acf69a06
SHA1 40fb89ea0979774566bf089311aa75e65755172e
SHA512 727434e6283808543b5aa55abdae0593ac761bdbbfc8ced042893c4f082bae665cbd84ee4166aa0a3ee88e80b1317d05a4c48039f5d1db65da46f3d46440240b
TLSH
T1331144A1876475B28C3C928F89D137424BD06413C0C605087DA14B184DAB20FA3AA707
MD5 SHA1 SHA512 TLSH

Submit Download

9e751d6a-404b-4186-8be4-c87f6ff18cc5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\9e751d6a-404b-4186-8be4-c87f6ff18cc5
Size 235B
SHA256 8a0023277f8717cf1b64f92e7b5b2f211d41c23810a86de267cdbbee25980f50
MD5 8dc8ba4fb26659a12cec176dd72ebced
SHA1 689413440a2e41c0db604d4583013fa80095f21c
SHA512 1ca30dec74c33ab6ed7a873c42ff7afe9ccc7abeb7da283d4ad24f147a671502a4d93e0cb1650f8cd5b12faa520d7dd7a1cc77a6be1e4a65aaa85c4f81908966
TLSH
T1A1D097C01488735C18040F07F0A528C634948C336470AC2096E184788EFCAC40322816
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
Size 16KB
SHA256 fbdbe23c43e1983f188a126601d870403873370db34aa7dce7ebf3fa1c9bee93
MD5 45dd09a2efe1ee33f2265723d7c73a8d
SHA1 119f1a0e569dfae0d356acd22504a2dfc3d893ce
SHA512 3fa11726be2e17899126895f21c3eb205bcd8a2b40ae5d2872ac6cc2dcb49d1843b758f876960b6964a5f371d5169f303d40eedc9c667bb09bc030a0f54d5bc7
SSDEEP 384:LkI4vUUmldvS8dhWp94z7j96ohiL4HsL4PoL4HFL4HwL4Hr+4hJ:4I4cRfHXY4Z6N4G4y4F4S4a4D
TLSH
T1FE72431545049EB8294FA78AAA367E02C37D573B70845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 6KB
SHA256 4cacf69a01b67cbc502e48acde269bdfc929151dec89c21a75ee00f9551f2874
MD5 e1191422f72f382c717d1ce81eead31c
SHA1 767f8b74cbfe9601cb1f2b7e3c93687f2432649c
SHA512 2542fe723ae6529f5df4258087ec9519ce2761d7d0eaa3249a1307b5ef446e5cd1b397f7a42ddcf59247a719c05c0a4788c7fbff12f87f7e67e555e98c5affbc
SSDEEP 96:xHGqUTUmK4qGqvfWRA1zSpSSlQdv9jznoRHmBw88u8L4cnSqoL0:oqWKTRvfWRAQSSz9mBw88nZ
TLSH
T159E12F7891188F7F74B6776CAC6888716A72023B7BBF68D710B94484450CF3482F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
Size 7KB
SHA256 76db8e6eaf22500650137b7c009c24fc02bff344a08bc2b15abc912245e2666a
MD5 cbf4eb2b7bb5bf3040aa182dd75d3ed4
SHA1 912b1fb4baa97a0ec7ed3eeb74abd8b4c28e3d33
SHA512 e24cc648048513ace94b561eb271b618f6f32fdf35f419b571f5ca97959ab1c3cc740345cb2bc2fe8eaf69b1d7d3b4e327a42a36b21c136e3e1f8181bddf5f26
SSDEEP 96:xHGqpTUmK4qGqvfV7DNbzSySSlQdv9js+noRWRuQmJQZBw88/ugIg8L4cnSqoLx9:oqvKTRvfV7DTSSXD8RbBw88/ulhS
TLSH
T1EEF1FD385504CF7F68B6766CAC2849719A62023BBBBF68D720BA54C4450CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 12KB
SHA256 15e962082f59a6e2a54b28544b60657acfe4cc40c41b24570926f3445e42db54
MD5 689c7dfbd037bef6651ac3e18a4a299e
SHA1 581f58991872f93342db6cfdf520a8a98f7d7f43
SHA512 a0c896404337bb702e97dc316bfa336e118d4101fc120c94c72ad9d428db5851753100ce05e431701f27150ecf03415ea252943652bc1c959f661b1511e50c51
SSDEEP 192:oqvKTCRvfV7DQSSXDXLRHOBw88m97trEvkk8gNhyaiulRrXvrb8mo0VTVzqS/Qh5:PKiG/RMw34z
TLSH
T1CE42CD385540CB3F24B2327DBC2949B059A212277ABFFCD615FAA4C1550CF6481F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 12KB
SHA256 dfaf81a5177403a8bf28a8943e9154f77e54dcc319b9c2a4149599afee5476e6
MD5 c20688540c724da9829c505997af79e3
SHA1 f5d52899507ba7a7364d060a458fb8ae23635260
SHA512 011868463fec2519229a21b027a9f51bfd6a5380e9491bb67935a8490e7e98abffee34f7109324b2a1b6f9cb454c181102394fcf13acfd8a5c33c28078e3d13c
SSDEEP 192:oqvKTRvfV7DQSSXDXLRHOBw88m97trEvkk8gNhyaiulRrXvrb8mo0VTVzqS/QhQW:PKNG/RMw34z
TLSH
T10642DD385540CB3F24B2327DBC2949B059A212277ABFFCD615FAA4C1550CF6481F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 7KB
SHA256 ab4ee705324460d4e58c5589213182f1386b784ebd9a9c13aecf9a5c75b049b1
MD5 498ff8d283e09c7c82ae24f8b09b717c
SHA1 96e5e85abf9d2efe8e52f40b97f10b1d7d76af56
SHA512 e5b35cf7939edb3bd7130a4db9b4fe0c8bbba4ba659be04d9802ef73c487e3f052475cec15c350d038eda492f87fe9fb4fdbdb1a7c40d28c338acdadf4d429e5
SSDEEP 96:xHGqUTUmK4qGqvfW7DNbzSySSlQdv9js+noRHmBw88u8L4cnSqoLxGS:oqWKTRvfW7DTSSXD9mBw88nS
TLSH
T13DE11F7895088F6F68B6776CAC6888716A72013B7BBF68D710B554C4050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
Size 6KB
SHA256 7e2b50f8c6e52e8908aa17ac0898b2afbaf755c7717e67bec4c7fef49e531f76
MD5 9d3e5226122f6cddd98531b4a75a7c5c
SHA1 7e935459bf60c522f9fdf99315cee2a737b13d4c
SHA512 5f2a00c842a27c07cc4d7aed020db89fc1916b2e01ec267d67529bc5352f62566e59d4c21221a2998111cd9e30d202fe5d36436d07b2d4f5c92d8b3288a7b641
SSDEEP 96:xHGqUTUmK4qGqvfW7D1zSySSlQdv9jznoRHmBw88u8L4cnSqoLxGS:oqWKTRvfW7DnSSz9mBw88nS
TLSH
T176E1207855088F6F74B6776CAC6888716A72023B7BBF68D750B65484050CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 54645d72d8f7a9a16a8f7368cc76d686f17afd15b93c5fe1ced7bbdf42b825b9
MD5 9138e963f917cca30a427a48d92678a4
SHA1 54141bb39382d95a76fe50250cb918c1fc76e8c6
SHA512 1360f390a1ce7db5ff26283dab964f25b509753aedc6879110a3b16f8f7a66f5e85337c9160ee88a65407eda96f220369f0a779865ae0c370283e3353bdfdb7d
TLSH
T10B31B593FF0B2C6571A0C44A88CD77ECABF6902143B099F0D9A9A6410984B5732CA34A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 25e1c384d4fb518fe19a40ede7aa48f10292eaf162ada5d232001acf7ea98a34
MD5 5fec6c84bf334ba922fab246c0c88e37
SHA1 4882e76ddcd9933ea4283079741c021276502ca7
SHA512 6dc4bd034a3cc53a148187c0b4fdfa1bf630276da25fd9cbbb33187379e893c0188c17605e20888d260d88ab73a744f2092664457e1f9706f9ff5823147525ca
TLSH
T1FF21EA93F86B1FB77761D065D84D9BE5C7A93031C97504F081CD471169AC94A728960D
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
Size 5KB
SHA256 6b815231aaf506e7211b5d603e7f556dd9b09ae910aa64f86bbf427440d5313a
MD5 b0cd88f896257c9e82ba1a9b3241de82
SHA1 fc326f14aa3dc5527f01044f06a2da58975fc401
SHA512 6cf98b75a9b690ca9f5f7be25d1492ffcb87d3fee345fcea30f0e66233a984392f6ccdc3ce75a83f9c926e06d935ff3a32e71eb22415a9be87b461d06dfe4101
SSDEEP 96:92wGzfjzs99O4yc6HalwyAccPvHcxa3FCm7VLlwsKn81rCd01VrqM4EcZZi6rLKM:9NOfHK9UcpwyAcIv8c1GsKn81ri0v/4B
TLSH
T1F2C18DB3AC132CAB09B6D5504CEE0F9587F21088C27E0355DE18777101EC7AAAD8A72F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a1725b32-59b1-4e2e-94fe-554806a468c2}.final

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\default\https+++www.virustotal.com\cache\morgue\194\{a1725b32-59b1-4e2e-94fe-554806a468c2}.final
Size 72KB
SHA256 37b10abb39bb126d39d49e23a8683ffbea0d7d27e6f3c818b6a317aca9d00463
MD5 b70a4bd8e93fd22544118b81c9ae29c6
SHA1 e24a1ded27e97da7100de9656560ebb0a8cc8005
SHA512 0fe99aaa1c7171474f1a3e3d06c7287930950d83408ea6934a4ed1cf3398718c6c8ab77f922796e19174b15ff9e18eee343d6a2816f612e98f9ff89947332827
SSDEEP 1536:fd8f0gb3drU/OU7R+2amgAQ6AU9joUwhwZw+UQEeg2RiNwkf6:fd8f/xUnozgQ6AIjoX5eBEpf6
TLSH
T14473F1FA3F20BDD7743611F7E9896CEC53BC2A02768EB089D265B5D128A2664EF15108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 b898b058b477a661a273c30c6d250792f26c747ce0f467581bbb2a773cd1cf5f
MD5 98db357f00415c48b6d436fe51bbfa9a
SHA1 49cb9deed254404ac2db1a8cd8d1e310968c7419
SHA512 60f7221a88086ab3ce5f7eea30c8a184f08067b58a98456406e68a638e853779619aa4733c6e5f45fb738a8a2604322d22db07a9355276b4c275f767cfeec7c8
SSDEEP 49152:nLALylaeUT6QC5zYYck6CJ0SEteVe8WDxsF2s/2/vXwcM2WlqkSYnFFtNL8DllK4:IvGXtpgllKrOjWk5
TLSH
T18D765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Users\Admin\Desktop\spoolsv.exe
Size 12.0MB
SHA256 49438895149a54652b34f3eab5263b4c7633b76d35bfe908b89bf9bbf6995372
MD5 364b6a74c2427695abf234021c88f4ca
SHA1 12dfa7166953496ef3d7046682c5460f6c8ee62d
SHA512 546e39253d0aa300ec5d739e7827c8efc34892340b5dd0de356b4554c21f89c77c98328aad296c1370b12b6f0e6b8ebe9756a305e9ca43ad6bb70b51e9bc20e1
SSDEEP 98304:irN2aXdrjxCaTbqAEEC6OIw4+G2IfkED:LaxdTe0C63weVD
TLSH
T14BC65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF8776911C6A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upx-5.iaOipKCl.2.0-win64.zip.part

Path C:\Users\Admin\Downloads\upx-5.iaOipKCl.2.0-win64.zip.part
Size 659KB
SHA256 b471ebf1b7f20f4a89150264ed9a008a2a5bfd247f3c6d1184a75bb59ca08f5d
MD5 ee157f2b6b49d1afb5fe6522010e3cc3
SHA1 5be53e62f35319493c6a9951e2adb67f0eebb598
SHA512 6ef97baa2b85865aad9014a88020c6d0e7520854c94021120763f84f9f4ca13f14d585dbd3a66c4061aa1f1b42aeea7c9ee908b3acf153c40f99199e08e6a739
SSDEEP 12288:yUXql7GVOmG7Rj4d56ap8AizB1qqit+chHw5ExpXzI64OX/FkctnSZvMxf:yU27r0fmAOIt+SQ5ExFDNHtnSpMxf
TLSH
T14CE4239BCD0C2061B760DA74CF1EF78AE440A06B4F7B0B7D1B433AF29EA954DD985216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-52-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1503-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1139-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1294-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-2281-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-2260-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-2232-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1335-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-2212-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-2198-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-2115-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-41-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1424-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1425-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1426-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-42-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-43-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1433-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-44-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-996-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-83-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-1985-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/248-409-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/1496-1434-0x0000000000B90000-0x00000000017E4000-memory.dmp

Download

memory/1496-1457-0x0000000000B90000-0x00000000017E4000-memory.dmp

Download

memory/2380-987-0x0000000006420000-0x0000000006486000-memory.dmp

Download

memory/2380-991-0x0000000006500000-0x000000000685B000-memory.dmp

Download

memory/2380-1116-0x0000000009250000-0x000000000980A000-memory.dmp

Download

memory/2380-984-0x00000000031E0000-0x0000000003216000-memory.dmp

Download

memory/2380-1046-0x0000000007FD0000-0x0000000007FEA000-memory.dmp

Download

memory/2380-1019-0x0000000007E80000-0x0000000007F23000-memory.dmp

Download

memory/2380-985-0x0000000005CB0000-0x00000000062FA000-memory.dmp

Download

memory/2380-1018-0x0000000007E60000-0x0000000007E80000-memory.dmp

Download

memory/2380-1015-0x00000000700B0000-0x000000007040B000-memory.dmp

Download

memory/2380-1014-0x000000006FF50000-0x000000006FF9C000-memory.dmp

Download

memory/2380-1013-0x0000000007E20000-0x0000000007E56000-memory.dmp

Download

memory/2380-992-0x0000000006A20000-0x0000000006A3E000-memory.dmp

Download

memory/2380-1115-0x00000000084D0000-0x00000000084F2000-memory.dmp

Download

memory/2380-1069-0x0000000008140000-0x00000000081D6000-memory.dmp

Download

memory/2380-1045-0x0000000008610000-0x0000000008C8C000-memory.dmp

Download

memory/2380-988-0x0000000006490000-0x00000000064F6000-memory.dmp

Download

memory/2380-1007-0x0000000006E30000-0x0000000006E78000-memory.dmp

Download

memory/2380-1067-0x0000000008030000-0x000000000803A000-memory.dmp

Download

memory/2380-986-0x0000000006380000-0x00000000063A2000-memory.dmp

Download

memory/2380-993-0x0000000006A40000-0x0000000006A8C000-memory.dmp

Download

memory/2540-1461-0x0000000000910000-0x0000000001564000-memory.dmp

Download

memory/2540-1444-0x0000000000910000-0x0000000001564000-memory.dmp

Download

memory/2556-10-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/2556-2-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/2556-4-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/2556-12-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/2556-9-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/2556-8-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/2556-13-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/2556-11-0x0000026251920000-0x0000026251921000-memory.dmp

Download

memory/3808-1459-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/3808-1441-0x0000000000330000-0x0000000000F84000-memory.dmp

Download

memory/4528-1443-0x0000000000890000-0x00000000014E4000-memory.dmp

Download

memory/4528-1458-0x0000000000890000-0x00000000014E4000-memory.dmp

Download

memory/4860-27-0x0000000000070000-0x0000000000CC4000-memory.dmp

Download

memory/4860-40-0x0000000000070000-0x0000000000CC4000-memory.dmp

Download

memory/4860-0-0x0000000000070000-0x0000000000CC4000-memory.dmp

Download

memory/4860-1-0x0000000000070000-0x0000000000CC4000-memory.dmp

Download

memory/5428-1008-0x0000000000D20000-0x0000000001974000-memory.dmp

Download

memory/5428-1006-0x0000000000D20000-0x0000000001974000-memory.dmp

Download

memory/6100-1427-0x0000000000400000-0x000000000066C000-memory.dmp

Download

memory/6100-1431-0x0000000000400000-0x000000000066C000-memory.dmp

Download