Overview

overview

8

Static

static

3

orbshacker.exe

windows10-2004-x64

1

orbshacker.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    1032s
  • max time network
    1036s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 02:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    orbshacker.exe
  • Size 14.4MB
  • Sample260817-ckmdpsdm2x
  • SHA256 270d9001570dfc31016f62d9c21f48b33b56fff90f23e1b505793fea879373c0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistencephishingransomwarespywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 21 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in Windows directory 36 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 8 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 46 IoCs
  • Modifies registry key 1 TTPs 10 IoCs
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 50 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\orbshacker.exe
    "C:\Users\Admin\AppData\Local\Temp\orbshacker.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Users\Admin\AppData\Local\Temp\orbshacker.exe
      "C:\Users\Admin\AppData\Local\Temp\orbshacker.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:6020
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:4920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:4600
      • C:\Users\Admin\Desktop\Win64\genshinimpact.exe
        C:\Users\Admin\Desktop\Win64\genshinimpact.exe
        3⤵
        • Executes dropped EXE
        PID:5520
        • C:\Users\Admin\Desktop\Win64\genshinimpact.exe
          C:\Users\Admin\Desktop\Win64\genshinimpact.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3084
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:7064
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:2696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:6168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:6008
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:4468
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cls"
        3⤵
        • Executes a command shell one-liner
        PID:2164
  • C:\Program Files\Mozilla Firefox\private_browsing.exe
    "C:\Program Files\Mozilla Firefox\private_browsing.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4144
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
        3⤵
        • Downloads MZ/PE file
        • Drops desktop.ini file(s)
        • Subvert Trust Controls: Mark-of-the-Web Bypass
        • Modifies registry class
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5824
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {d839919f-d02a-47a2-bdc9-23bc60309d9d} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
            PID:4304
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {5f45b84e-285f-40c4-ad9a-92e460ae03db} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
              PID:1704
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 27198 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3948 -initialChannelId {36247f7e-30dd-430e-8c2c-c2b740406b8b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              4⤵
                PID:1076
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27198 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {c8f0708f-a600-4a94-b06a-55fb1a782e7a} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                4⤵
                  PID:4692
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3324 -prefsLen 34753 -prefMapHandle 3076 -prefMapSize 270279 -jsInitHandle 3080 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3332 -initialChannelId {3978df8b-6604-4449-a152-8b071d023087} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  4⤵
                  • Checks processor information in registry
                  PID:3376
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5096 -prefsLen 34909 -prefMapHandle 5100 -prefMapSize 270279 -ipcHandle 5112 -initialChannelId {62dbce97-26a6-416c-8c58-123a65629079} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  4⤵
                    PID:6180
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 32872 -prefMapHandle 5324 -prefMapSize 270279 -jsInitHandle 5328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4824 -initialChannelId {3f3dcc47-449f-4787-a563-b67f5b30c99c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                    4⤵
                      PID:6372
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32872 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {4447c9a6-653b-4d0f-8111-7af952af4a96} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                      4⤵
                      • Checks processor information in registry
                      PID:6460
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32924 -prefMapHandle 5808 -prefMapSize 270279 -jsInitHandle 5844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {8cd52de5-f3ad-46a1-891b-d523f186ea5a} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                      4⤵
                        PID:6468
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6320 -prefsLen 33043 -prefMapHandle 6324 -prefMapSize 270279 -jsInitHandle 6328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6336 -initialChannelId {84ffd52f-5920-4c32-b19f-e11ab52dcc9c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                        4⤵
                          PID:7100
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6620 -prefsLen 35161 -prefMapHandle 6712 -prefMapSize 270279 -ipcHandle 4492 -initialChannelId {77086ba7-2815-411f-b561-09dd8252abad} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
                          4⤵
                          • Checks processor information in registry
                          PID:4924
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6716 -prefsLen 33043 -prefMapHandle 6720 -prefMapSize 270279 -jsInitHandle 6676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2756 -initialChannelId {96701487-0db4-437d-a1cb-95ffd2919794} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                          4⤵
                            PID:5316
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7552 -prefsLen 36952 -prefMapHandle 7556 -prefMapSize 270279 -jsInitHandle 7560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7568 -initialChannelId {22e99239-7228-4749-8325-7afdd2366935} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
                            4⤵
                              PID:2504
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 36952 -prefMapHandle 7732 -prefMapSize 270279 -jsInitHandle 7556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7584 -initialChannelId {e47ae310-bf98-48d4-8bbc-8d9f881c1962} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
                              4⤵
                                PID:3656
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6504 -prefsLen 36952 -prefMapHandle 6500 -prefMapSize 270279 -jsInitHandle 6344 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7792 -initialChannelId {3a2cdded-08e6-43ab-9de7-bc336506a96c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
                                4⤵
                                  PID:560
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7448 -prefsLen 36952 -prefMapHandle 3896 -prefMapSize 270279 -jsInitHandle 4944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8804 -initialChannelId {a0df564f-a761-4542-8b74-91f139df1215} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
                                  4⤵
                                    PID:1388
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6980 -prefsLen 36952 -prefMapHandle 9128 -prefMapSize 270279 -jsInitHandle 6452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6364 -initialChannelId {5e8d12cc-57aa-456a-b4c6-30c309b37e61} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
                                    4⤵
                                    • Checks processor information in registry
                                    PID:4932
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 36952 -prefMapHandle 6388 -prefMapSize 270279 -jsInitHandle 6548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6604 -initialChannelId {59160e43-0dfd-444b-b3af-2f86469879d9} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
                                    4⤵
                                      PID:8480
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9108 -prefsLen 36952 -prefMapHandle 9000 -prefMapSize 270279 -jsInitHandle 5988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6036 -initialChannelId {02614d0d-75b2-4e43-9d7a-96a2fe6f2e40} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
                                      4⤵
                                      • Checks processor information in registry
                                      PID:9100
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7596 -prefsLen 36952 -prefMapHandle 9172 -prefMapSize 270279 -jsInitHandle 6060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {ae0a730f-9f0a-48d6-a958-f3b2ac295cfc} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
                                      4⤵
                                        PID:9076
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6472 -prefsLen 36952 -prefMapHandle 7624 -prefMapSize 270279 -jsInitHandle 9128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7628 -initialChannelId {b6e06c02-632d-458f-8b3a-fff02d177d4b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 21 tab
                                        4⤵
                                          PID:5080
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8864 -prefsLen 36952 -prefMapHandle 8836 -prefMapSize 270279 -jsInitHandle 8904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8952 -initialChannelId {7328dec0-31b8-4728-a5f6-dcb9bdf8ef16} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 22 tab
                                          4⤵
                                          • Checks processor information in registry
                                          PID:7084
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 36952 -prefMapHandle 9012 -prefMapSize 270279 -jsInitHandle 9100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9060 -initialChannelId {0b0239a2-0003-46da-bd8d-3ec521156232} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 23 tab
                                          4⤵
                                          • Checks processor information in registry
                                          PID:6960
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7468 -prefsLen 36952 -prefMapHandle 7720 -prefMapSize 270279 -jsInitHandle 7568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5896 -initialChannelId {97639df4-8968-4530-abff-10ca22ddd723} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 24 tab
                                          4⤵
                                          • Checks processor information in registry
                                          PID:5648
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9808 -prefsLen 36952 -prefMapHandle 9804 -prefMapSize 270279 -jsInitHandle 9728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9720 -initialChannelId {79888719-a846-4236-855f-b1690c6f337c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab
                                          4⤵
                                          • Checks processor information in registry
                                          PID:6200
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10036 -prefsLen 36952 -prefMapHandle 10076 -prefMapSize 270279 -jsInitHandle 8008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10100 -initialChannelId {d87f0b37-b662-44f3-a20e-ef6a25678631} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 26 tab
                                          4⤵
                                            PID:7336
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10268 -prefsLen 36952 -prefMapHandle 10312 -prefMapSize 270279 -jsInitHandle 10320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10328 -initialChannelId {1a50f4b5-209e-4575-bac6-2c8dfd84a202} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab
                                            4⤵
                                            • Checks processor information in registry
                                            PID:11176
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9548 -prefsLen 36952 -prefMapHandle 7468 -prefMapSize 270279 -jsInitHandle 10004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9996 -initialChannelId {1c894bb4-b001-42d8-98fd-2d405fc68d54} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab
                                            4⤵
                                            • Checks processor information in registry
                                            PID:5104
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9788 -prefsLen 36952 -prefMapHandle 9784 -prefMapSize 270279 -jsInitHandle 9780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9772 -initialChannelId {b56b196d-303b-4082-b21d-78e30a52ffc8} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab
                                            4⤵
                                            • Checks processor information in registry
                                            PID:5832
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10260 -prefsLen 36952 -prefMapHandle 10248 -prefMapSize 270279 -jsInitHandle 10244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10232 -initialChannelId {728e7ef1-8271-4fd7-be2a-eb30c441d78c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 30 tab
                                            4⤵
                                              PID:2132
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10988 -prefsLen 36952 -prefMapHandle 10992 -prefMapSize 270279 -jsInitHandle 10996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10248 -initialChannelId {507a4ae1-9229-4e1d-8d59-1f16dec2262b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 31 tab
                                              4⤵
                                              • Checks processor information in registry
                                              PID:3200
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11184 -prefsLen 36952 -prefMapHandle 11188 -prefMapSize 270279 -jsInitHandle 11192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10268 -initialChannelId {694f037e-550d-4e53-acb1-a1ba4e31b177} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 32 tab
                                              4⤵
                                                PID:6436
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11208 -prefsLen 36952 -prefMapHandle 11212 -prefMapSize 270279 -jsInitHandle 11216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11224 -initialChannelId {54d44806-d2ec-4053-8473-828b9811f01f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 33 tab
                                                4⤵
                                                  PID:6868
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13036 -prefsLen 36952 -prefMapHandle 13040 -prefMapSize 270279 -jsInitHandle 13044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13052 -initialChannelId {ac0ecd4b-69b0-4385-835d-8d1fb3d48416} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 34 tab
                                                  4⤵
                                                    PID:9492
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13196 -prefsLen 36952 -prefMapHandle 13192 -prefMapSize 270279 -jsInitHandle 13236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13248 -initialChannelId {6d99872c-2bfe-4ac9-b827-ec4fa83fd024} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 35 tab
                                                    4⤵
                                                      PID:7016
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13708 -prefsLen 36952 -prefMapHandle 13740 -prefMapSize 270279 -jsInitHandle 13704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13768 -initialChannelId {daa0306c-2f8a-405b-a419-70448c94dc5d} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 36 tab
                                                      4⤵
                                                        PID:1088
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13768 -prefsLen 36952 -prefMapHandle 13864 -prefMapSize 270279 -jsInitHandle 13784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13884 -initialChannelId {126b867b-f239-4c07-a0e8-2e94f4da57e0} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 37 tab
                                                        4⤵
                                                          PID:8352
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14120 -prefsLen 36952 -prefMapHandle 14124 -prefMapSize 270279 -jsInitHandle 14128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14136 -initialChannelId {ef3976b3-1f1c-49d2-acda-a7aabce58037} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 38 tab
                                                          4⤵
                                                            PID:10020
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13844 -prefsLen 36952 -prefMapHandle 13840 -prefMapSize 270279 -jsInitHandle 13836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13012 -initialChannelId {ba47d574-d3f7-4c8d-8785-3115ccae82d3} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab
                                                            4⤵
                                                            • Checks processor information in registry
                                                            PID:7812
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14464 -prefsLen 36952 -prefMapHandle 14468 -prefMapSize 270279 -jsInitHandle 14472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14416 -initialChannelId {b1868fc0-5aef-49cb-80b5-79c3430ecda9} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 40 tab
                                                            4⤵
                                                              PID:9652
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14692 -prefsLen 36952 -prefMapHandle 14696 -prefMapSize 270279 -jsInitHandle 14700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9076 -initialChannelId {1ce4d54c-bad3-474d-a37b-748270117baf} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab
                                                              4⤵
                                                                PID:9856
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14916 -prefsLen 36952 -prefMapHandle 14920 -prefMapSize 270279 -jsInitHandle 14924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14932 -initialChannelId {9bb83efc-ccb9-4852-85bc-f9509b3adcb7} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 42 tab
                                                                4⤵
                                                                  PID:5308
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13824 -prefsLen 36952 -prefMapHandle 14364 -prefMapSize 270279 -jsInitHandle 14368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14688 -initialChannelId {d7677b98-3976-48a0-8c75-91e4501dec9b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 43 tab
                                                                  4⤵
                                                                    PID:7056
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14376 -prefsLen 36952 -prefMapHandle 14380 -prefMapSize 270279 -jsInitHandle 14384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14396 -initialChannelId {c5743e14-49bf-4f0a-9d17-3723e082b5da} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab
                                                                    4⤵
                                                                    • Checks processor information in registry
                                                                    PID:6280
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15588 -prefsLen 36952 -prefMapHandle 15592 -prefMapSize 270279 -jsInitHandle 15596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15440 -initialChannelId {2260ffdc-cdf3-4f08-bc39-24fe4b4e504f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 45 tab
                                                                    4⤵
                                                                      PID:1228
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15612 -prefsLen 36952 -prefMapHandle 15616 -prefMapSize 270279 -jsInitHandle 15620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15432 -initialChannelId {bc507aa5-6e24-455b-bcb7-0440df3dbd18} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 46 tab
                                                                      4⤵
                                                                      • Checks processor information in registry
                                                                      PID:5172
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15416 -prefsLen 36952 -prefMapHandle 14372 -prefMapSize 270279 -jsInitHandle 14664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13844 -initialChannelId {3c80448c-ffb2-4c9f-8294-b4375763eb5a} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 47 tab
                                                                      4⤵
                                                                        PID:4364
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27388 -prefsLen 37436 -prefMapHandle 27396 -prefMapSize 270279 -jsInitHandle 27400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27404 -initialChannelId {89cfd318-f15c-45c0-8d85-18cb0eb7af9f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 48 tab
                                                                        4⤵
                                                                        • Checks processor information in registry
                                                                        PID:13044
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12300 -prefsLen 37436 -prefMapHandle 14668 -prefMapSize 270279 -jsInitHandle 16676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14672 -initialChannelId {413b9896-9758-4986-9e1b-a632cebb807c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 49 tab
                                                                        4⤵
                                                                          PID:12116
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12368 -prefsLen 37436 -prefMapHandle 12404 -prefMapSize 270279 -jsInitHandle 12408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12416 -initialChannelId {4d9fd514-2695-4d68-8692-55630556e962} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 50 tab
                                                                          4⤵
                                                                          • Checks processor information in registry
                                                                          PID:13864
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11736 -prefsLen 37436 -prefMapHandle 11740 -prefMapSize 270279 -jsInitHandle 8680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8392 -initialChannelId {ef748944-dad9-4766-a495-ef6a5825a34d} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 51 tab
                                                                          4⤵
                                                                            PID:14004
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12492 -prefsLen 37436 -prefMapHandle 12500 -prefMapSize 270279 -jsInitHandle 12516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15884 -initialChannelId {51676ce7-fd63-4af9-aec1-da526d515019} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 52 tab
                                                                            4⤵
                                                                              PID:11428
                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27660 -prefsLen 37436 -prefMapHandle 12660 -prefMapSize 270279 -jsInitHandle 16052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27676 -initialChannelId {df479a81-1ccd-4f5c-a9f9-30119d658ac2} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 53 tab
                                                                              4⤵
                                                                              • Checks processor information in registry
                                                                              PID:12140
                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16100 -prefsLen 37436 -prefMapHandle 16096 -prefMapSize 270279 -jsInitHandle 16092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15480 -initialChannelId {dafb83ac-faf4-4454-9f6f-75cf8b43a383} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 54 tab
                                                                              4⤵
                                                                                PID:13420
                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15752 -prefsLen 37436 -prefMapHandle 16100 -prefMapSize 270279 -jsInitHandle 16096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12840 -initialChannelId {2210ec51-600b-4ee6-951c-601c9cc5935a} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 55 tab
                                                                                4⤵
                                                                                  PID:11272
                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8164 -prefsLen 37436 -prefMapHandle 7224 -prefMapSize 270279 -jsInitHandle 8044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8388 -initialChannelId {87886017-8aa5-490e-8b99-b7916f912cbb} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 56 tab
                                                                                  4⤵
                                                                                    PID:12340
                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13532 -prefsLen 37436 -prefMapHandle 13752 -prefMapSize 270279 -jsInitHandle 3516 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9504 -initialChannelId {3a354233-f2da-46f2-8d73-63ef73a0643c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 57 tab
                                                                                    4⤵
                                                                                      PID:12680
                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12924 -prefsLen 37436 -prefMapHandle 4476 -prefMapSize 270279 -jsInitHandle 4480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4472 -initialChannelId {9af77145-93ce-4544-bae3-b5aed50ab727} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 58 tab
                                                                                      4⤵
                                                                                        PID:9660
                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12928 -prefsLen 37436 -prefMapHandle 16044 -prefMapSize 270279 -jsInitHandle 16024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4500 -initialChannelId {db464825-75f4-43b9-ba8c-118a83d2b407} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 59 tab
                                                                                        4⤵
                                                                                          PID:10952
                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14372 -prefsLen 37487 -prefMapHandle 4496 -prefMapSize 270279 -jsInitHandle 16060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12012 -initialChannelId {02e3d153-a46b-4888-b586-300d8f327e34} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 60 tab
                                                                                          4⤵
                                                                                            PID:13356
                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 37487 -prefMapHandle 13136 -prefMapSize 270279 -jsInitHandle 13140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13128 -initialChannelId {d0e987c1-e75d-4e44-8a2a-fc172c4fa962} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 61 tab
                                                                                            4⤵
                                                                                              PID:13536
                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15720 -prefsLen 37487 -prefMapHandle 15388 -prefMapSize 270279 -jsInitHandle 14932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15748 -initialChannelId {d8b8ba4b-e513-4930-b50c-e32fe1e57c23} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 62 tab
                                                                                              4⤵
                                                                                              • Checks processor information in registry
                                                                                              PID:13532
                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13040 -prefsLen 37487 -prefMapHandle 13404 -prefMapSize 270279 -jsInitHandle 13796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10260 -initialChannelId {94b9cbda-fa0f-4465-9cbb-9833adfb79c1} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 63 tab
                                                                                              4⤵
                                                                                                PID:14136
                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16148 -prefsLen 37487 -prefMapHandle 16176 -prefMapSize 270279 -jsInitHandle 16196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11360 -initialChannelId {180a99aa-43d1-45af-940e-8a6d525f8991} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 64 tab
                                                                                                4⤵
                                                                                                  PID:14148
                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10988 -prefsLen 37487 -prefMapHandle 11540 -prefMapSize 270279 -jsInitHandle 10976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11484 -initialChannelId {7a6ee86e-e4ef-4f4b-9a53-35a5c306fef3} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 65 tab
                                                                                                  4⤵
                                                                                                    PID:14176
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8172 -prefsLen 37487 -prefMapHandle 9432 -prefMapSize 270279 -jsInitHandle 8168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5912 -initialChannelId {17cb4fd6-7c79-49a2-abe7-7918055432fc} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 66 tab
                                                                                                    4⤵
                                                                                                      PID:14196
                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14540 -prefsLen 37487 -prefMapHandle 14524 -prefMapSize 270279 -jsInitHandle 14528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7972 -initialChannelId {9860aae9-c411-4d75-9939-54c6b6e35ee9} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 67 tab
                                                                                                      4⤵
                                                                                                        PID:8032
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15552 -prefsLen 37487 -prefMapHandle 14476 -prefMapSize 270279 -jsInitHandle 14164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15340 -initialChannelId {f2b05001-07ab-4923-83d2-fb5477278324} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 68 tab
                                                                                                        4⤵
                                                                                                          PID:2684
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15284 -prefsLen 37487 -prefMapHandle 15156 -prefMapSize 270279 -jsInitHandle 14384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15048 -initialChannelId {9fc3431e-6506-43aa-82da-7c7bc574fea7} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 69 tab
                                                                                                          4⤵
                                                                                                            PID:6492
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9116 -prefsLen 37487 -prefMapHandle 6948 -prefMapSize 270279 -jsInitHandle 10708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11340 -initialChannelId {91780b54-f5c2-4dc5-a4df-b2e47dac25d7} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 70 tab
                                                                                                            4⤵
                                                                                                              PID:8892
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10580 -prefsLen 37487 -prefMapHandle 9012 -prefMapSize 270279 -jsInitHandle 9100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10640 -initialChannelId {a21d8c09-793f-4f1c-8b73-fcdec2cd35e2} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 71 tab
                                                                                                              4⤵
                                                                                                                PID:4284
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8864 -prefsLen 37487 -prefMapHandle 10620 -prefMapSize 270279 -jsInitHandle 10608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9840 -initialChannelId {0ff2c478-de87-40ea-96ed-f6aee90f3efa} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 72 tab
                                                                                                                4⤵
                                                                                                                • Checks processor information in registry
                                                                                                                PID:13700
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 37487 -prefMapHandle 8836 -prefMapSize 270279 -jsInitHandle 9992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13784 -initialChannelId {9895e991-3ab8-4122-88e6-d57773e03a15} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 73 tab
                                                                                                                4⤵
                                                                                                                  PID:13712
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8792 -prefsLen 37487 -prefMapHandle 14356 -prefMapSize 270279 -jsInitHandle 14020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14028 -initialChannelId {14bc6679-aab5-4709-b1e9-7084fec40ea6} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 74 tab
                                                                                                                  4⤵
                                                                                                                  • Checks processor information in registry
                                                                                                                  PID:13728
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15852 -prefsLen 37487 -prefMapHandle 14904 -prefMapSize 270279 -jsInitHandle 7596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14900 -initialChannelId {768145fa-9a20-49c7-a0e2-49f506d020b2} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 75 tab
                                                                                                                  4⤵
                                                                                                                    PID:9832
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14552 -prefsLen 37487 -prefMapHandle 14536 -prefMapSize 270279 -jsInitHandle 14524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14568 -initialChannelId {0225492e-0475-4256-b147-be54c1abc8ea} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 76 tab
                                                                                                                    4⤵
                                                                                                                      PID:11468
                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14208 -prefsLen 37487 -prefMapHandle 14192 -prefMapSize 270279 -jsInitHandle 14196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8864 -initialChannelId {84af6741-12d3-4974-b332-0d070a6da716} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 77 tab
                                                                                                                      4⤵
                                                                                                                        PID:12064
                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13816 -prefsLen 37487 -prefMapHandle 13828 -prefMapSize 270279 -jsInitHandle 13832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14184 -initialChannelId {7a98f2e8-c20e-4100-8624-4c052b258baa} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 78 tab
                                                                                                                        4⤵
                                                                                                                        • Checks processor information in registry
                                                                                                                        PID:13236
                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5884 -prefsLen 37487 -prefMapHandle 8996 -prefMapSize 270279 -jsInitHandle 9008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6804 -initialChannelId {3532a3d4-c59d-48a2-8802-155b67986feb} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 79 tab
                                                                                                                        4⤵
                                                                                                                        • Checks processor information in registry
                                                                                                                        PID:14316
                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14128 -prefsLen 37487 -prefMapHandle 14324 -prefMapSize 270279 -jsInitHandle 14208 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14020 -initialChannelId {12c386a4-e843-48f7-94c0-d81ed096ff15} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 80 tab
                                                                                                                        4⤵
                                                                                                                          PID:9564
                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9420 -prefsLen 37487 -prefMapHandle 11540 -prefMapSize 270279 -jsInitHandle 10988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11536 -initialChannelId {f7eef561-de51-4c26-8b61-1e149cdfba8c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 81 tab
                                                                                                                          4⤵
                                                                                                                            PID:11852
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9604 -prefsLen 37487 -prefMapHandle 9620 -prefMapSize 270279 -jsInitHandle 11776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9568 -initialChannelId {955965e0-a6e4-46c7-a126-861a9c7c9a7b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 82 tab
                                                                                                                            4⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            PID:14012
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13964 -prefsLen 37487 -prefMapHandle 13952 -prefMapSize 270279 -jsInitHandle 13940 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12748 -initialChannelId {03c5bba6-a156-4fcd-ab40-4a5b5f53ec28} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 83 tab
                                                                                                                            4⤵
                                                                                                                              PID:14044
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11740 -prefsLen 37487 -prefMapHandle 9508 -prefMapSize 270279 -jsInitHandle 7796 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14764 -initialChannelId {6f331714-196b-41ee-85fc-bc5bd1a8095d} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 84 tab
                                                                                                                              4⤵
                                                                                                                                PID:13292
                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10076 -prefsLen 37487 -prefMapHandle 10220 -prefMapSize 270279 -jsInitHandle 6360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9212 -initialChannelId {8949786f-2375-4a5f-88de-2d41ce1ac847} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 85 tab
                                                                                                                                4⤵
                                                                                                                                  PID:11344
                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27516 -prefsLen 37487 -prefMapHandle 17128 -prefMapSize 270279 -jsInitHandle 27584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9324 -initialChannelId {86d3d07a-285d-4453-b819-2d85d6c359b5} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 86 tab
                                                                                                                                  4⤵
                                                                                                                                    PID:7432
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13976 -prefsLen 37487 -prefMapHandle 13988 -prefMapSize 270279 -jsInitHandle 12232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 12804 -initialChannelId {8c4bd171-1a99-4170-aa8e-061fae5904b6} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 87 tab
                                                                                                                                    4⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    PID:5400
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 17128 -prefsLen 37487 -prefMapHandle 27516 -prefMapSize 270279 -jsInitHandle 9632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 10516 -initialChannelId {fa50a44c-596b-4094-a35c-f6ea0e6ff488} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 88 tab
                                                                                                                                    4⤵
                                                                                                                                      PID:6956
                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 10492 -prefsLen 37487 -prefMapHandle 15296 -prefMapSize 270279 -jsInitHandle 15308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11564 -initialChannelId {62ba519d-4e8f-43a1-8155-06cd83e745d4} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 89 tab
                                                                                                                                      4⤵
                                                                                                                                        PID:9352
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5984 -prefsLen 37487 -prefMapHandle 11884 -prefMapSize 270279 -jsInitHandle 8152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14968 -initialChannelId {a94bff42-e26f-4d7d-ab6f-776cf5459721} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 90 tab
                                                                                                                                        4⤵
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        PID:11268
                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 8776 -prefsLen 37487 -prefMapHandle 14068 -prefMapSize 270279 -jsInitHandle 13792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14076 -initialChannelId {8033806a-6413-40a2-9dd7-2178cb3bf605} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 91 tab
                                                                                                                                        4⤵
                                                                                                                                          PID:7664
                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 9384 -prefsLen 37487 -prefMapHandle 12972 -prefMapSize 270279 -jsInitHandle 15188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7800 -initialChannelId {c1f107ee-37d1-4d5f-9294-a9f4136eddd7} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 92 tab
                                                                                                                                          4⤵
                                                                                                                                            PID:7888
                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15224 -prefsLen 37487 -prefMapHandle 15208 -prefMapSize 270279 -jsInitHandle 15232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5940 -initialChannelId {b0f3f7ac-be5e-41e8-abca-b8c48718a9e0} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 93 tab
                                                                                                                                            4⤵
                                                                                                                                              PID:5300
                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5952 -prefsLen 37487 -prefMapHandle 7140 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14092 -initialChannelId {1465e849-3381-4fbe-8179-d744bcb7112c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 94 tab
                                                                                                                                              4⤵
                                                                                                                                                PID:9132
                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5956 -prefsLen 37487 -prefMapHandle 7628 -prefMapSize 270279 -jsInitHandle 6600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9660 -initialChannelId {bf9757bd-cdcf-41c1-9252-7c5395b43f77} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 95 tab
                                                                                                                                                4⤵
                                                                                                                                                • Checks processor information in registry
                                                                                                                                                PID:260
                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21272 -prefsLen 37487 -prefMapHandle 13936 -prefMapSize 270279 -jsInitHandle 21292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 21300 -initialChannelId {07966a9d-2682-4f58-b803-52c30d49d42b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 96 tab
                                                                                                                                                4⤵
                                                                                                                                                  PID:10644
                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11204 -prefsLen 37487 -prefMapHandle 16540 -prefMapSize 270279 -jsInitHandle 16092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8380 -initialChannelId {30d19c34-b393-4962-8f71-6e93de13a845} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 97 tab
                                                                                                                                                  4⤵
                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                  PID:12924
                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13516 -prefsLen 37487 -prefMapHandle 12184 -prefMapSize 270279 -jsInitHandle 10564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7980 -initialChannelId {dea9b6e6-fa48-4129-b33b-c9d34b1d793f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 98 tab
                                                                                                                                                  4⤵
                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                  PID:5704
                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12416 -prefsLen 37487 -prefMapHandle 12404 -prefMapSize 270279 -jsInitHandle 16252 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11368 -initialChannelId {4a689694-af2e-48f0-a9b8-4cc24c4425f5} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 99 tab
                                                                                                                                                  4⤵
                                                                                                                                                    PID:13484
                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20396 -prefsLen 37487 -prefMapHandle 20400 -prefMapSize 270279 -jsInitHandle 20328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20896 -initialChannelId {77f0cedb-0a55-4bcc-b925-6125756ae13c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 100 tab
                                                                                                                                                    4⤵
                                                                                                                                                      PID:13552
                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24904 -prefsLen 37487 -prefMapHandle 5472 -prefMapSize 270279 -jsInitHandle 9624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11956 -initialChannelId {d88676e0-3b00-4ae4-b0e3-8292021d37f9} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 101 tab
                                                                                                                                                      4⤵
                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                      PID:13340
                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 30128 -prefsLen 37487 -prefMapHandle 30136 -prefMapSize 270279 -jsInitHandle 28408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30144 -initialChannelId {52370385-02da-439d-9f9d-5f8744421944} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 102 tab
                                                                                                                                                      4⤵
                                                                                                                                                        PID:8168
                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21092 -prefsLen 37487 -prefMapHandle 21096 -prefMapSize 270279 -jsInitHandle 21100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30068 -initialChannelId {98d72aae-cd74-4191-8c60-5f67c92e324d} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 103 tab
                                                                                                                                                        4⤵
                                                                                                                                                          PID:9344
                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 26468 -prefsLen 37487 -prefMapHandle 25440 -prefMapSize 270279 -jsInitHandle 25436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27196 -initialChannelId {eeca808b-f783-463d-8575-180983244b08} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 104 tab
                                                                                                                                                          4⤵
                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                          PID:10128
                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27112 -prefsLen 37487 -prefMapHandle 27048 -prefMapSize 270279 -jsInitHandle 26476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 26936 -initialChannelId {a63e9707-d442-42da-bab4-86c113ff73be} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 105 tab
                                                                                                                                                          4⤵
                                                                                                                                                            PID:9484
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19592 -prefsLen 37487 -prefMapHandle 19568 -prefMapSize 270279 -jsInitHandle 19580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23388 -initialChannelId {c4e9c294-84cc-4298-a893-5def8796d404} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 106 tab
                                                                                                                                                            4⤵
                                                                                                                                                              PID:10988
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 23896 -prefsLen 37487 -prefMapHandle 23892 -prefMapSize 270279 -jsInitHandle 23888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19492 -initialChannelId {9956bfde-1d62-469a-a203-0e55c7b0a639} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 107 tab
                                                                                                                                                              4⤵
                                                                                                                                                                PID:10840
                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 30616 -prefsLen 37487 -prefMapHandle 5916 -prefMapSize 270279 -jsInitHandle 30548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30620 -initialChannelId {54a10f07-5a2a-4119-bcb4-692bbd9a0d5a} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 108 tab
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:8008
                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24176 -prefsLen 37487 -prefMapHandle 31000 -prefMapSize 270279 -jsInitHandle 24232 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23716 -initialChannelId {1664b941-11bd-42e6-99c1-2c23fc4ecce2} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 109 tab
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:10860
                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 25052 -prefsLen 37487 -prefMapHandle 27136 -prefMapSize 270279 -jsInitHandle 25060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25068 -initialChannelId {cc87956a-22e0-4b19-b3fc-e66f2b78f72c} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 110 tab
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                    PID:7476
                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19948 -prefsLen 37487 -prefMapHandle 19996 -prefMapSize 270279 -jsInitHandle 25060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24380 -initialChannelId {2075cdd8-6680-4769-9ed9-11c31da3b4f1} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 111 tab
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4564
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19568 -prefsLen 37487 -prefMapHandle 19592 -prefMapSize 270279 -jsInitHandle 23684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20216 -initialChannelId {1e6b8d7b-aa74-4581-87ed-1a86306e6644} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 112 tab
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                      PID:6860
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 31024 -prefsLen 37487 -prefMapHandle 31028 -prefMapSize 270279 -jsInitHandle 15872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24380 -initialChannelId {6eeeaaa5-9843-409a-9eff-6d870f8cdfbc} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 113 tab
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:10172
                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20588 -prefsLen 37487 -prefMapHandle 17868 -prefMapSize 270279 -jsInitHandle 17996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30644 -initialChannelId {99e14f70-8fbc-4ce8-aeee-2eb7193568b7} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 114 tab
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:6136
                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 12556 -prefsLen 37487 -prefMapHandle 25004 -prefMapSize 270279 -jsInitHandle 11176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 16088 -initialChannelId {ffec54bb-a27a-4c34-b763-300b1420fbca} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 115 tab
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:5512
                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15564 -prefsLen 37487 -prefMapHandle 6788 -prefMapSize 270279 -jsInitHandle 15072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14580 -initialChannelId {9e555a06-02ea-4a5b-906c-3e4362ce952f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 116 tab
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:10060
                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 13916 -prefsLen 37487 -prefMapHandle 14016 -prefMapSize 270279 -jsInitHandle 14008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11140 -initialChannelId {26e8e4e2-b3ce-4b37-8135-bfaa099b3b2a} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 117 tab
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:5932
                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16656 -prefsLen 37487 -prefMapHandle 16596 -prefMapSize 270279 -jsInitHandle 11524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 26740 -initialChannelId {ba1ddfff-6f21-4664-8829-e7e6c870618f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 118 tab
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                PID:8408
                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11204 -prefsLen 37487 -prefMapHandle 26700 -prefMapSize 270279 -jsInitHandle 11812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20576 -initialChannelId {f640ffa7-0ad6-47ce-a0df-acc3b95ccadd} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 119 tab
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                PID:9488
                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 24456 -prefsLen 37487 -prefMapHandle 9384 -prefMapSize 270279 -jsInitHandle 8588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 8312 -initialChannelId {111e2b11-1d2c-408f-bdf2-6f149d030275} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 120 tab
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:7336
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7780 -prefsLen 37487 -prefMapHandle 17104 -prefMapSize 270279 -jsInitHandle 15892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25420 -initialChannelId {0d74db26-001b-4778-99a0-301d0f70859a} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 121 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                  PID:3200
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20132 -prefsLen 37487 -prefMapHandle 20108 -prefMapSize 270279 -jsInitHandle 20064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11800 -initialChannelId {b779d943-e4a7-418a-8c28-0945a1e50469} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 122 tab
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:14164
                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27996 -prefsLen 37487 -prefMapHandle 7772 -prefMapSize 270279 -jsInitHandle 14528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 25008 -initialChannelId {c2f9eaad-5f8b-4404-a5d1-8b0cfd4caee3} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 123 tab
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:11936
                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 15132 -prefsLen 37487 -prefMapHandle 11380 -prefMapSize 270279 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30616 -initialChannelId {06350b8f-daa7-465f-81eb-a7fc0b28594b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 124 tab
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:6668
                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14076 -prefsLen 37487 -prefMapHandle 18124 -prefMapSize 270279 -jsInitHandle 16052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24776 -initialChannelId {7ed705f4-4c7a-46fc-938e-55781ce06c71} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 125 tab
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:10916
                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27164 -prefsLen 37487 -prefMapHandle 27148 -prefMapSize 270279 -jsInitHandle 27152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24772 -initialChannelId {b8cbcb34-b44e-4ec1-875c-e9b535faa1d2} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 126 tab
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:13984
                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 26880 -prefsLen 37487 -prefMapHandle 27144 -prefMapSize 270279 -jsInitHandle 26892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 28016 -initialChannelId {8351a8b5-dd91-486b-b344-746a94baf3c8} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 127 tab
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:3056
                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16336 -prefsLen 37487 -prefMapHandle 30616 -prefMapSize 270279 -jsInitHandle 21156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5888 -initialChannelId {1e44b838-1ba6-4fdd-812f-07bbf306edb3} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 128 tab
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:9480
                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 16480 -prefsLen 37487 -prefMapHandle 21404 -prefMapSize 270279 -jsInitHandle 12952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13712 -initialChannelId {56a05f69-82c2-4524-b1c5-5ba0553b927b} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 129 tab
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                PID:7724
                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20772 -prefsLen 37487 -prefMapHandle 20776 -prefMapSize 270279 -jsInitHandle 20876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13976 -initialChannelId {7d467c01-f4c3-460c-8aa6-cc50207eee88} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 130 tab
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19932 -prefsLen 37487 -prefMapHandle 19916 -prefMapSize 270279 -jsInitHandle 19880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6028 -initialChannelId {517053ca-c8be-49df-be6a-026022c8b262} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 131 tab
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19944 -prefsLen 37487 -prefMapHandle 20840 -prefMapSize 270279 -jsInitHandle 11700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 20768 -initialChannelId {1864c828-f737-4631-b851-117b497dad2f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 132 tab
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:6808
                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 27136 -prefsLen 37487 -prefMapHandle 19968 -prefMapSize 270279 -jsInitHandle 31036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 31040 -initialChannelId {456d8519-95ae-4943-a27a-757019fe0d87} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 133 tab
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:5308
                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 28296 -prefsLen 37487 -prefMapHandle 20404 -prefMapSize 270279 -jsInitHandle 20648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 19916 -initialChannelId {d3301193-ea28-449f-95ed-1c08003ca401} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 134 tab
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 21324 -prefsLen 37487 -prefMapHandle 9484 -prefMapSize 270279 -jsInitHandle 26888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 23744 -initialChannelId {41ca5e91-518b-4c33-af58-0dd2f4246361} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 135 tab
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:11072
                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 19808 -prefsLen 37487 -prefMapHandle 24708 -prefMapSize 270279 -jsInitHandle 24704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24620 -initialChannelId {e2b65567-d4fa-493c-be4b-3d9f1d310b87} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 136 tab
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:12248
                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20616 -prefsLen 37487 -prefMapHandle 20748 -prefMapSize 270279 -jsInitHandle 15016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7128 -initialChannelId {0295325b-a4a8-479e-9d91-4be0015996b1} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 137 tab
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 26864 -prefsLen 37487 -prefMapHandle 14540 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 13344 -initialChannelId {0737b8c8-d3d1-4500-84df-5f6479b3d8bc} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 138 tab
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                PID:12988
                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14328 -prefsLen 37487 -prefMapHandle 26864 -prefMapSize 270279 -jsInitHandle 14540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 17012 -initialChannelId {f2336b5d-063d-46b9-b5ad-c4abe8c5df08} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 139 tab
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:13796
                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20560 -prefsLen 37487 -prefMapHandle 21032 -prefMapSize 270279 -jsInitHandle 21028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30208 -initialChannelId {94a080b3-e528-471b-90e2-1438270af502} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 140 tab
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:14200
                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 20628 -prefsLen 37487 -prefMapHandle 20756 -prefMapSize 270279 -jsInitHandle 20620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30288 -initialChannelId {f903fe37-1166-49a8-a1d7-2eca37b90cc3} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 141 tab
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:14208
                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 25528 -prefsLen 37487 -prefMapHandle 12368 -prefMapSize 270279 -jsInitHandle 21256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24700 -initialChannelId {611c1b4b-7752-499f-b9d5-f33d6e3e9f8d} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 142 tab
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:14216
                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 14472 -prefsLen 37487 -prefMapHandle 14700 -prefMapSize 270279 -jsInitHandle 14588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 14800 -initialChannelId {bd476ea6-6a02-412c-a454-f5b3f28edfde} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 143 tab
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                        PID:364
                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6048 -prefsLen 37487 -prefMapHandle 9736 -prefMapSize 270279 -jsInitHandle 15136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 9100 -initialChannelId {be364fcf-a051-4880-81ac-310341b59c3d} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 144 tab
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 31336 -prefsLen 37487 -prefMapHandle 6912 -prefMapSize 270279 -jsInitHandle 27708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 24824 -initialChannelId {bd18ee38-31c2-47a0-ab78-cfcbe8839d56} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 145 tab
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:3380
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 11128 -prefsLen 37487 -prefMapHandle 15256 -prefMapSize 270279 -jsInitHandle 6988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 11104 -initialChannelId {372d5ef6-5028-42ea-9196-0a808be17dae} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 146 tab
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 25424 -prefsLen 37487 -prefMapHandle 13380 -prefMapSize 270279 -jsInitHandle 14472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 15400 -initialChannelId {ef0c64da-3c31-4254-a5c6-53beb2ca9a3f} -parentPid 5824 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5824" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 147 tab
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:9356
                                                                                                                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4872
                                                                                                                                                                                                                          • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                            PID:6560
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                              PID:6864
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --squirrel-install 1.0.9253
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9253 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4d8,0x4dc,0x4e0,0x4d4,0x4e4,0x7ff74187e998,0x7ff74187e9a8,0x7ff74187e9b8
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:5584
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1824
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,18180007625508157060,5518705897415355070,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1900,i,7217446847259675836,14972697291150010621,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1892 /prefetch:2
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1896,i,18180007625508157060,5518705897415355070,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1900,i,7217446847259675836,14972697291150010621,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1932 /prefetch:11
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:6192
                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                  C:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                  PID:3392
                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                  C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                  PID:6092
                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                  C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                  PID:2164
                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                  C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                  PID:5472
                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                  C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe\",-1" /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                  PID:2908
                                                                                                                                                                                                                                • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                  C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe\" --url -- \"%1\"" /f
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                  PID:3944
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --squirrel-firstrun
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                                PID:6756
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9253 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4d4,0x4d8,0x4dc,0x4d0,0x4e0,0x7ff74187e998,0x7ff74187e9a8,0x7ff74187e9b8
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:1700
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1788 /prefetch:2
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1988 /prefetch:11
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3864
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786931929638932 --launch-time-ticks=1006804459 --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2508 --splash-media-format=webm /prefetch:1
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:6364
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1786931929638932 --launch-time-ticks=1012618332 --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3960 --enable-node-leakage-in-renderers /prefetch:1
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:10604
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1786931929638932 --launch-time-ticks=1012989219 --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4140 --enable-node-leakage-in-renderers /prefetch:1
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:10672
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
                                                                                                                                                                                                                                    "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
                                                                                                                                                                                                                                    "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:1276
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
                                                                                                                                                                                                                                    "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
                                                                                                                                                                                                                                    "\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                    PID:3308
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4296 /prefetch:12
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:7688
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4324 /prefetch:14
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:7696
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=065c6a08-5e9b-4bc3-bb8a-df00d9626ee5
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                  PID:9548
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffff430c188,0x7ffff430c194,0x7ffff430c1a0
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:9584
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,13935332314451435580,439954395376923939,262144 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:9876
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,6173765207030417618,1374247507741947448,524288 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                        • System Time Discovery
                                                                                                                                                                                                                                        PID:9868
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2700,i,7137238335313662793,14471971861821760911,524288 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:9908
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,11264880981050469140,14332621115934016741,2097152 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:10040
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,17082381444936838509,1967636222510090298,2097152 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:10048
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,5052649878192952567,47694144301924486,2097152 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:10216
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5472215956995200958,9408895717716588650,2097152 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                  PID:10228
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1977346363211874747,2962268929284314044,524288 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:11148
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5340,i,13184102902703272802,13819226988641789250,2097152 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:11256
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,8872380463824228544,16889799589137832206,524288 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:8000
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,4086375216326465352,14750215627762132530,524288 --field-trial-handle=2208,i,2274077965076463902,16210402640364385241,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:8008
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:10036
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1786931929638932 --launch-time-ticks=1092870828 --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3604 --enable-node-leakage-in-renderers /prefetch:1
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:8956
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5500 /prefetch:10
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:8564
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1786931929638932 --launch-time-ticks=1223421606 --field-trial-handle=1792,i,16331493392567912562,7297910244970323939,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1796,i,1952519293183923129,16514591953108764026,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3604 --enable-node-leakage-in-renderers /prefetch:1
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:11616
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Discord\Update.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:6768
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --start-inactive
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:6576
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9253 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4d8,0x4dc,0x4e0,0x464,0x4e4,0x7ff74187e998,0x7ff74187e9a8,0x7ff74187e9b8
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:3948
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1780,i,7324556935111206259,11354634923868815156,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1784,i,16971450988921472384,17310147791706920135,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1776 /prefetch:2
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1780,i,7324556935111206259,11354634923868815156,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1784,i,16971450988921472384,17310147791706920135,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1984 /prefetch:11
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:4712
                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:6808
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1780,i,7324556935111206259,11354634923868815156,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1784,i,16971450988921472384,17310147791706920135,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2852 --splash-media-format=webm /prefetch:1
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                        PID:6944
                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:7092
                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe\",-1" /f
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:3324
                                                                                                                                                                                                                                                      • C:\Windows\System32\reg.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\Discord.exe\" --url -- \"%1\"" /f
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:2908
                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:1844
                                                                                                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F0
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:7060
                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:1824
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:2716
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:7096
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:4600
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:124
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:6676
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:5856
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:1064
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:5100
                                                                                                                                                                                                                                                        • C:\Windows\System32\ShellHost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\ShellHost.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                                                                        • C:\Windows\System32\DataExchangeHost.exe
                                                                                                                                                                                                                                                          C:\Windows\System32\DataExchangeHost.exe -Embedding
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:3596
                                                                                                                                                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\Win64\genshinimpact.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Desktop\Win64\genshinimpact.exe"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4584
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\Win64\genshinimpact.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\Win64\genshinimpact.exe"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                PID:8060
                                                                                                                                                                                                                                                            • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              PID:2844
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4900
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                                                                                                                                                                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\SquirrelTemp\SquirrelSetup.log
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                • Opens file in notepad (likely ransom note)
                                                                                                                                                                                                                                                                PID:1360
                                                                                                                                                                                                                                                            • C:\Users\Admin\Downloads\DiscordSetup.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\Downloads\DiscordSetup.exe"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:1376
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4788
                                                                                                                                                                                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:3420
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:10068
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                PID:9244
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x32c,0x7ffff430c188,0x7ffff430c194,0x7ffff430c1a0
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:10044
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,389131700867925664,17182316653637164556,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                    • System Time Discovery
                                                                                                                                                                                                                                                                    PID:10332
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,3584309844421734748,12955744249832052650,262144 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:10324
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,3677093935580274171,12113592385981098172,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:10492
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,6186920714920466207,11732488317134559098,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:10648
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,6186920714920466207,11732488317134559098,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:10644
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,6442572068496586998,9188588871042945966,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:10976
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,11820374224762030170,14502952345381292196,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:3056
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,9814910192695285681,16148615473163268034,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:6892
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,6832627270556310607,18044124717753458625,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:9948
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,17986200543402515434,12625224286844554987,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:3480
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,9743564414561421932,10339491646889905503,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3176
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6664627599694756344,9430581668299712991,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2964
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,1862331460389606029,2398101377052069173,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4668,i,14537883204225967667,10474768333781015836,262144 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:10
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:12536
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,11110923314610898123,348576639472824559,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:12644
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2800,i,13749404450603324247,62784951831126643,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:13088
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,7002556899592170177,16761176317012249126,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:12204
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,5195464574606274331,1481825828614054671,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=1092 /prefetch:14
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:11588
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,251924452542809582,16255621359202336563,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:12852
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16295787730058415935,17391315160905153176,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:13332
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,5466593423795281258,16839869398587847779,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:8104
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,14906996693851369268,12924261704751270731,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:4336
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,12624321850164866176,5489699416370026274,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:12252
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,9544205217179386156,10544224306498906685,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:10036
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,1877329886573110937,8896156939868668738,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1120
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,2699896313430427190,14580088829184659517,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2288
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,7631361795833513077,16375448763656586455,524288 --field-trial-handle=1916,i,14909621074427120642,17225738244509149472,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:9564
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:10312
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                                                                                                                                                                                        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:11348
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:7540
                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                              PID:12908
                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 31799 -prefMapHandle 1956 -prefMapSize 271030 -ipcHandle 2020 -initialChannelId {c284fd1f-0277-4621-a9be-3c3df59143a0} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:11124
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 31799 -prefMapHandle 2156 -prefMapSize 271030 -ipcHandle 2252 -initialChannelId {8749c7a2-890c-4239-97c6-4408af444bc5} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:7964
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 32358 -prefMapHandle 3864 -prefMapSize 271030 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {9408b62d-338e-4e6e-b1cb-5ac2da7ca22d} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:9812
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 32358 -prefMapHandle 4052 -prefMapSize 271030 -ipcHandle 4104 -initialChannelId {cbcd4b18-2234-4ba8-b625-13132511128f} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:11384
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2556 -prefsLen 39914 -prefMapHandle 2808 -prefMapSize 271030 -jsInitHandle 2840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3188 -initialChannelId {d9738e69-41a1-409c-82ba-b72dee4164b7} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:9352
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4708 -prefsLen 39963 -prefMapHandle 3204 -prefMapSize 271030 -ipcHandle 4984 -initialChannelId {1bbb860d-2aab-4dce-8314-916023a8fa9b} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:7736
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5616 -prefsLen 36879 -prefMapHandle 5624 -prefMapSize 271030 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {e0b4c5eb-33aa-4f6d-8798-2345525e5429} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:9500
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 36879 -prefMapHandle 5744 -prefMapSize 271030 -jsInitHandle 5748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5756 -initialChannelId {44420517-039d-4fb5-b524-e5c0b1772130} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:6196
                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6000 -prefsLen 36879 -prefMapHandle 5996 -prefMapSize 271030 -jsInitHandle 6160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6168 -initialChannelId {70939bdb-0664-477e-8049-a4b3de2390e2} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2440
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6036 -prefsLen 36919 -prefMapHandle 6032 -prefMapSize 271030 -jsInitHandle 6028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6400 -initialChannelId {6f73e249-8b47-44b2-997b-ed982dc62488} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4876
                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6688 -prefsLen 36919 -prefMapHandle 6692 -prefMapSize 271030 -jsInitHandle 6696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6740 -initialChannelId {a74a48a2-f6d0-41c2-8eae-6a02ed36868f} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2428 -prefsLen 36919 -prefMapHandle 3292 -prefMapSize 271030 -jsInitHandle 3172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {f683a3e3-8e36-4176-8753-8289a0eb8336} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:9356
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7092 -prefsLen 36919 -prefMapHandle 7100 -prefMapSize 271030 -jsInitHandle 7096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6980 -initialChannelId {1a3a7e33-4df2-492b-bc0b-e93c2e207770} -parentPid 12908 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12908" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:8084

                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                                                                          Windows Command Shell

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1059.003

                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                                                          Subvert Trust Controls

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1553

                                                                                                                                                                                                                                                                                                                                                          SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1553.003

                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                          Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1217

                                                                                                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                                                                                                                                          System Time Discovery

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1124

                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                          F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\D3DSCache\a3e52581ff9bf219\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                                                                          • Size 4B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          app.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\app.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 278KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          chrome_100_percent.pak
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\chrome_100_percent.pak
                                                                                                                                                                                                                                                                                                                                                          • Size 117KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 15a5bcb49a5c02d6a4e736e8dfa11dabb0bac0589641a4e25f0c06472ccaae6d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          chrome_200_percent.pak
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\chrome_200_percent.pak
                                                                                                                                                                                                                                                                                                                                                          • Size 192KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b7acfb068fa681f4ecb8f782bd4e3926590076c61fd0de3de4a12dde227cf52b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          icudtl.dat
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\icudtl.dat
                                                                                                                                                                                                                                                                                                                                                          • Size 10.4MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          en-US.pak
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\locales\en-US.pak
                                                                                                                                                                                                                                                                                                                                                          • Size 550KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a46e37e61c7cdedf5d407f2be6440a895decb42f408ebc4f0cd0575026214ec6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          package.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_spellcheck-1\discord_spellcheck\package.json
                                                                                                                                                                                                                                                                                                                                                          • Size 25B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4f35fd6a3f2046e09ecc02576752378eeb7cd7b48db490d3358111c27e808866
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gpu_encoder_helper.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 891KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 76559ac41582749060a238a3af5fd7a9ba571e26f244a954c4ef62c1153713bc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          resources.pak
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources.pak
                                                                                                                                                                                                                                                                                                                                                          • Size 6.3MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c0061855e2714674043841c3db83ddffb764890c2e6c03894a4a537f126af701
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          app.asar
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\app.asar
                                                                                                                                                                                                                                                                                                                                                          • Size 3.4MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 86e96c594e40707d7be89b9f243a6f223de081ca81805f32e91285f0429bd9fe
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          build_info.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\resources\build_info.json
                                                                                                                                                                                                                                                                                                                                                          • Size 175B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9404e9de8ee5cba075dda2f8ee6174274e2d042eabb9cb3e7671c1fbf2a65a06
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          v8_context_snapshot.bin
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\app-1.0.9253\v8_context_snapshot.bin
                                                                                                                                                                                                                                                                                                                                                          • Size 704KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 47efa82a5cbdce5a4810e9e62e9dc04c52cbce5c7afeb38bb2b331f4243fa9d9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          3c670f215f9f94673a94beda0ca1f5166d3f26f17f18a9470abd5b748f82b167
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\3c670f215f9f94673a94beda0ca1f5166d3f26f17f18a9470abd5b748f82b167
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3c670f215f9f94673a94beda0ca1f5166d3f26f17f18a9470abd5b748f82b167
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          502ba13cc08816d1474d699276ca74369f027ab1c8b59c61f4b9bf9ff877bd50
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\502ba13cc08816d1474d699276ca74369f027ab1c8b59c61f4b9bf9ff877bd50
                                                                                                                                                                                                                                                                                                                                                          • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 502ba13cc08816d1474d699276ca74369f027ab1c8b59c61f4b9bf9ff877bd50
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          587b2f094943261df39e2b7ddc7471094caaf745da0da5e10eff56768f2e19a5
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\587b2f094943261df39e2b7ddc7471094caaf745da0da5e10eff56768f2e19a5
                                                                                                                                                                                                                                                                                                                                                          • Size 409KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 587b2f094943261df39e2b7ddc7471094caaf745da0da5e10eff56768f2e19a5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          630c40df51dc9b536a2ca306db91e28495f9057777c012bd1fe20179abf968eb
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\630c40df51dc9b536a2ca306db91e28495f9057777c012bd1fe20179abf968eb
                                                                                                                                                                                                                                                                                                                                                          • Size 600KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 630c40df51dc9b536a2ca306db91e28495f9057777c012bd1fe20179abf968eb
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          64f2550fb5b4fcc3949954349b5a7847b9c42d9efe33a1beba315fbf998043cd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\64f2550fb5b4fcc3949954349b5a7847b9c42d9efe33a1beba315fbf998043cd
                                                                                                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 64f2550fb5b4fcc3949954349b5a7847b9c42d9efe33a1beba315fbf998043cd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          7bf4730acfa9ac4f619e51763bf425681b9490e3630a38346d35a09d92538f66
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\7bf4730acfa9ac4f619e51763bf425681b9490e3630a38346d35a09d92538f66
                                                                                                                                                                                                                                                                                                                                                          • Size 8.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7bf4730acfa9ac4f619e51763bf425681b9490e3630a38346d35a09d92538f66
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          883819d2523a3b4a73fecb5043c096bbac80a4e7f3751a71293c2378094c162b
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\883819d2523a3b4a73fecb5043c096bbac80a4e7f3751a71293c2378094c162b
                                                                                                                                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 883819d2523a3b4a73fecb5043c096bbac80a4e7f3751a71293c2378094c162b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          92051395c98f4e842cc711dac50f850002f8ad41c824bd772b0632ed57bcfe52
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\92051395c98f4e842cc711dac50f850002f8ad41c824bd772b0632ed57bcfe52
                                                                                                                                                                                                                                                                                                                                                          • Size 20KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 92051395c98f4e842cc711dac50f850002f8ad41c824bd772b0632ed57bcfe52
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          9782e63735129efea8bf2435495e2a1aace2e0f58b4698099fb1b597e16ed6c4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\9782e63735129efea8bf2435495e2a1aace2e0f58b4698099fb1b597e16ed6c4
                                                                                                                                                                                                                                                                                                                                                          • Size 265KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9782e63735129efea8bf2435495e2a1aace2e0f58b4698099fb1b597e16ed6c4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          a16da706a20445d6768435d069e71f449732645736b843a442f890739c243727
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\a16da706a20445d6768435d069e71f449732645736b843a442f890739c243727
                                                                                                                                                                                                                                                                                                                                                          • Size 314KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a16da706a20445d6768435d069e71f449732645736b843a442f890739c243727
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ddef408f1abc3e3ab8606cd3170670f13568ceea714189c3862bfbc1940c6b7a
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\ddef408f1abc3e3ab8606cd3170670f13568ceea714189c3862bfbc1940c6b7a
                                                                                                                                                                                                                                                                                                                                                          • Size 222KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ddef408f1abc3e3ab8606cd3170670f13568ceea714189c3862bfbc1940c6b7a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ee34e88d0e77211601900f76fea3e35206c347aabf07996ee97b8ddc08b56a33
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\ee34e88d0e77211601900f76fea3e35206c347aabf07996ee97b8ddc08b56a33
                                                                                                                                                                                                                                                                                                                                                          • Size 514KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ee34e88d0e77211601900f76fea3e35206c347aabf07996ee97b8ddc08b56a33
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          f505da9eaa5aa270cb0cfd45c42705141fc733d60766e8b90ae0daf8a2f506e0
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\download\f505da9eaa5aa270cb0cfd45c42705141fc733d60766e8b90ae0daf8a2f506e0
                                                                                                                                                                                                                                                                                                                                                          • Size 27.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f505da9eaa5aa270cb0cfd45c42705141fc733d60766e8b90ae0daf8a2f506e0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          installer.db
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\installer.db
                                                                                                                                                                                                                                                                                                                                                          • Size 144KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 45ec5c88d90275fb8a14ed3a02e8bca97d7a015da1f4ad69fcc4ef26d37577e6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          installer.db
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\installer.db
                                                                                                                                                                                                                                                                                                                                                          • Size 276KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cff07331834916e2b9e9341721137eec2f7330fc45eb0355580395d869f95c8a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          installer.db
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\installer.db
                                                                                                                                                                                                                                                                                                                                                          • Size 276KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 388c5c014101cf3387172d260113c908b0cb832eb788d0c6e2d9938ef45f1e6e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          installer.db
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\installer.db
                                                                                                                                                                                                                                                                                                                                                          • Size 284KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 099e4eee6854e3db30edbe3b30d0ade5432355a92de1405d48f5b4ed010fbb1d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          RELEASES
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Discord\packages\RELEASES
                                                                                                                                                                                                                                                                                                                                                          • Size 73B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6ca55d388fd4ee81ca6a302d818e0d7b146863102595369b09308f312aff92a9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b73d1269710263f89147c3df740b27dd3688500b4f89702088f2f5c5d7dc1204
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                                          • Size 6B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f1f5e7cb2e484865c180d0dd530018ef43759dc1131c1ba6d2b3704733aac4fa
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                                          • Size 70KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          5ab4a275-c042-4186-9685-398ad8b18d55.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5ab4a275-c042-4186-9685-398ad8b18d55.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1a46b7887dd2db530aef0c3f19c88e3826da85d7fbda61d62e349f945081729a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a1432cfc465e3e46f1d700f37e2efd2f9aa19bc9f8e51591c82993ad3c55680f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                                          • Size 40B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 62d5cd0e97f9c627d4b12d4699ce3f6ecc41817fc9b90656e0597231490edaea
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4987fbb4be5a590e66e39022fa9a71db698302a8ce9e3c29d9c3ddd7d8374450
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b3686ce2c704a9b0e25f93bd0395528bfe7ef5400784c69509a145534092e825
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1e03c3a9e15fb67a638358895569e95f3c789194357f978ed0679794826cd0dc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                                          • Size 27KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cbb21a889d10dc4988e148ce8e33e5d05e1f6a695bec233ef88c09b6a0a8902e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cba195fea6ea624c83102a837e2c73235d92cf052aa52051aa8fc20b6c94356e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          e4283e6f-6e58-47ce-b32c-a1f49fd01b4c.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4283e6f-6e58-47ce-b32c-a1f49fd01b4c.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 414B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cb038d4fb5b98018fea0be2551d81fdde8a0e3a5d7ad6527aa23796dc703c931
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          fbd78b24-1315-485f-981a-4825db655755.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fbd78b24-1315-485f-981a-4825db655755.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 1B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          OperationConfig
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                                                                                                                                                                                                                          • Size 22KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          OperationConfig~RFe614f48.TMP
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe614f48.TMP
                                                                                                                                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 34KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cf83b58456b2d7c676376e38214217bffe25190fc836171f56de01252fa2f5c8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 57KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e30a299ba38c4712e56b461404e6be9b1d4c4b8bb4f2161fe6343cbfe514694c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 308600dfdf17ecc35739226cb4e2db842dc0860a8907ed231e09d73d52982d59
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 38KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e4a099b141fe2f3a6dd253f3fdd91d2cab8b5720ed17b2ad76799b3e277f6a74
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 38KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e40bca4afbe38c7e2c0d5e9089f21a9df94371b2ae442d87888dadfd68b837f4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1ce0f2b49142be82d6a0c03726f5b7b515439b1d743d62be1bc02f8560d1f207
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ebb644f76498403200e4b169feda1bc107e0c78bf7a13695c3e991cfa18f243d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                                          • Size 42KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 399de4d9bf878891e0f4c6570ffaecee223fafc27ee9531c224234ef70459481
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 492B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 132B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 732B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 852B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 372B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 612B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 972B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                                          • Size 252B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          14e58b57-f4c1-4cc3-a17f-225c02b501e1.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\14e58b57-f4c1-4cc3-a17f-225c02b501e1.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 13B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          activity-stream.contile.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.contile.json
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 33b771d68f6d8340d928be1eb4cfcf9945dc1309b867648855b2f6e1beff2ac1
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          activity-stream.discovery_stream.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.discovery_stream.json
                                                                                                                                                                                                                                                                                                                                                          • Size 75KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7e204d7181a250ce4e40860c36ff888b608c959e642af1b8d7659d2b90a2b51f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                                                                                                                                                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a1f8d2925aa1b3f8286059c6cff9c36d4fda5a689933429a7673f68a9c3ee5ca
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          webext.sc.lz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
                                                                                                                                                                                                                                                                                                                                                          • Size 105KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 75d1bb7945a50867d9c77527edb42192a8e7d12e1b5d48d38bfbc1c63a7bc95e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          RELEASES
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
                                                                                                                                                                                                                                                                                                                                                          • Size 81B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 774e955d967258a3792906980f05b1374b2e5ff184b0479e51c0ce779b99263b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Update.exe
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                                                                                                                                                                                                                                                                                                                                                          • Size 1.5MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 677f645f4cb08a941c42c596b18052e23a261191cf7e4ba852af5b16b0262160
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 214KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 52056f4b964f1bc0419064a374a32e56ef85ccb161166971d26f46a7490bd238
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 117KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          VCRUNTIME140_1.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\VCRUNTIME140_1.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 48KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _bz2.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 84KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _ctypes.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_ctypes.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 124KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 67KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _lzma.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 157KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _queue.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_queue.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _socket.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_socket.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 83KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _ssl.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 175KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          _wmi.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\_wmi.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 39KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          base_library.zip
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\base_library.zip
                                                                                                                                                                                                                                                                                                                                                          • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e0d9bd1cff2c36a3b8cc38187cb7f35949a615eb9935bb14fc921f62128618a9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          cacert.pem
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\certifi\cacert.pem
                                                                                                                                                                                                                                                                                                                                                          • Size 230KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          cd.cp312-win_amd64.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\charset_normalizer\cd.cp312-win_amd64.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 aec205186ce86077a5f8fb469e924cd5f7e183daed53f9de9362e77f3bf3637f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          libcrypto-3.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\libcrypto-3.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          libffi-8.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\libffi-8.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 38KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          libssl-3.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\libssl-3.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 776KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          python312.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\python312.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 6.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          select.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\select.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Lorem ipsum.txt
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          ucrtbase.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\ucrtbase.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31002\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          euc-cn.enc
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45842\_tcl_data\encoding\euc-cn.enc
                                                                                                                                                                                                                                                                                                                                                          • Size 84KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          dd31e5ae-b32d-469e-a445-0a055b6d96df.zip
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\dd31e5ae-b32d-469e-a445-0a055b6d96df.zip
                                                                                                                                                                                                                                                                                                                                                          • Size 3.8MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          f74b4e2b-bf06-48a0-9d61-2c913ae2ef89.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\f74b4e2b-bf06-48a0-9d61-2c913ae2ef89.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          content_new.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir9244_1644420882\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          tmpaddon
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                                                                                                                                                                                                                                                          • Size 502KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          tmpaddon
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                                                                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          default.exc
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                                                                                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          40371339ad31a7e6.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4a1fd898b1ec53c24bdfa29fab5384b7b15ebca64d18238e6d1b1b2d56f05a26
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9d29d1f9c949b16bd77ad9cf0cf8017a7b2644712495aafc9337534e1e6c7110
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 54e52d87462693c5950bc4574b8248173c033afcafcea6a1bb4d66c025681728
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d4f869034ead71321f14ca8a2b7d64f259f683dfa1df766f5599be676035a496
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3611bd5f84d2cbffa42b940f6643dd95390dd07668c8e9cf8a3e13df4ae3e0dd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9764bb70f725bfe6b938e53dec4ab21221966928d794a0fd5b593772fd9e7421
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 808962b422f6ad1e2213c0cbb8235f64c7a03d0920d9fc62d914e5f51d8d3068
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4f9bb95c517e3633d65d5ae4324560506abfd35e0b6741d980f8e13172aed3fe
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0b5f11e56aa7bef4572272bd6ddcd745282b670cbdb5bdc9b82d1fceaa7abafe
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e416569ac92e13b55f4fddc14538fb148f0e5e652e4882cfd08bf63d3a29e927
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7ad7e8c109a4a59b1f48b50ab942c354f97767fba9f44a8b7a74e05dad94bd79
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
                                                                                                                                                                                                                                                                                                                                                          • Size 26KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d1e9fee9166c21fdd26b12b19a951830d72ffb7cb7e37ceb9c34a996e18ee35d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          store.json.mozlz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\crashes\store.json.mozlz4
                                                                                                                                                                                                                                                                                                                                                          • Size 66B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 179KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ebd27deeafe3c88b70bd1bad2e3b9f94eb22d7063f67128b7323a5601ba48afd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 84KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3b06b9d53153c0bb84b3b8ab0a750c4fc10d9b6e9ec56f4ec396123a70250c24
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 180KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d7c3e1dbbf44d2e2cb37048b71809f522cebd3b9202c6ec4ceec9563e5f1ab6e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 863c1087d702e29e0f76ba7b1efddbee82ca895afbae2235154bc6d81321c4e6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 eabbb8e26d4338660478fd75e11fb3d4453011e4a05af04c21ff08e924bb95f4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          events
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4e8bb32b985f3cc85014515e570368c5298878493f4f291247651426c0df0723
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          events
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 4fb828b8371a3461b2471081ce51b9d31df10b1040cb11697048ef5939e2c974
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          events
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7cb15938aed650554d2412ed3b046410edb9c1db2ef741a93b1d3754c7c3b140
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          pageload
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\pageload
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2150fddd46fadf3caed1a005dbfb52306650c5521ef3c0c115b88020daf6d6b3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          0795ce44-e73a-4c3c-94d8-8bed64ee072f
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\0795ce44-e73a-4c3c-94d8-8bed64ee072f
                                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0727d6b3826393aa6dbeb8462b850b7cce682e38de7e7cd66643385ae3c99f16
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          293966cf-f5bd-4459-bab1-c26294212b65
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\293966cf-f5bd-4459-bab1-c26294212b65
                                                                                                                                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 06272b57da1ccbc7fdba8a81a03b968d1e31c174babc48eed17bb8066cd4af33
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          47427ac0-f3ea-41df-a5e5-045298876b4e
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\47427ac0-f3ea-41df-a5e5-045298876b4e
                                                                                                                                                                                                                                                                                                                                                          • Size 886B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5507788aad8209fffd1192852f5f0b7fa47f0e6d884288dc2262cb6b36d30108
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          668f9e32-16c0-4843-b426-54ed074c9071
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\668f9e32-16c0-4843-b426-54ed074c9071
                                                                                                                                                                                                                                                                                                                                                          • Size 991B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1b2d3cc1377d6882816a464ae31fbd1c0b28dd471ea0cafe44db12d07a016949
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          716c17ab-9141-4e40-a70f-2ab161a44258
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\716c17ab-9141-4e40-a70f-2ab161a44258
                                                                                                                                                                                                                                                                                                                                                          • Size 281B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7041001b0a826ac6e5c8e0ac071bc157b06f07a3144cf2b715e5724259dbcc8d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          83971ab6-0120-4db4-a834-3e9ca77cd138
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\83971ab6-0120-4db4-a834-3e9ca77cd138
                                                                                                                                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f89133bd6867c15113e0eccf301c976333a66ea0021de1f98bd197b2bce6aac9
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          83c265ed-e472-4d17-9a50-f138f5eaf283
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\83c265ed-e472-4d17-9a50-f138f5eaf283
                                                                                                                                                                                                                                                                                                                                                          • Size 869B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2dbc45bf524185c69addd03132fd0d5dbf47f35686af38b0ba2c02aaaad9b9ee
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          b869cea8-9c14-4432-aef1-7c519499b6f8
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\b869cea8-9c14-4432-aef1-7c519499b6f8
                                                                                                                                                                                                                                                                                                                                                          • Size 235B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d2a4d079d4a3cde562015549217204aad743eae0276bf9f1edffe44f0dd9a9d8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          cce3fb36-1686-4773-91d0-de7645f073e5
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\cce3fb36-1686-4773-91d0-de7645f073e5
                                                                                                                                                                                                                                                                                                                                                          • Size 871B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9a3a934ed97e64308faf0cd6217664b9ccd34d35aa84b7bec1d4efa22412b11b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          eab4a0f5-ebcc-4c85-893f-5a2f20089449
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\eab4a0f5-ebcc-4c85-893f-5a2f20089449
                                                                                                                                                                                                                                                                                                                                                          • Size 235B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3af0fce7c53cc111b220d8cd1d308d8025df21cfef62c26942be39750f334552
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          extensions.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
                                                                                                                                                                                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bdcdda3678dff389d2f2f705acf9ea1504d797ce5f217a10faf82bb5d33eeb18
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gmpopenh264.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          gmpopenh264.info
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                                                                                                                                                                                                                                                                                                          • Size 116B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                                                                                                                                                                                                                                                                                                          • Size 1002B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          widevinecdm.dll
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                                                                                                                                                                                                                                                                                                          • Size 21.6MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          logins-backup.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\logins-backup.json
                                                                                                                                                                                                                                                                                                                                                          • Size 756B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f4aa854170740cd971904b14ec72df4591fe1c1e240edbea15db5dd60a7025ff
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6ea6e666b7dfb74a77409951121e568954a3373b01300b60bf6a82feb4cd5d72
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a43a272a82ca68c57b0871ecba786a6a0ea0b4223a607f87e835b5e73e359c6c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 45b2aeb0543accb88dce1c6a5f812132cf0ab792e70f52c66cc5ff54db892b3d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8d57e6e73ce8006cb54ec4d4cf951af820be38af6310566484acc1bdab1b9a36
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 77f342023e426007d6dde9349fe318f032089a3eabec44aefacd86b6aef7d681
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1ba2df28293239f15cfecb3d142688225459153c32d73ca479e2d29735647feb
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a534d1849a0e25919f30f819cd81a73d68008b14532668ca27ae0eefd24b4a00
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 dc395ec8f26dc5f69d8f062f67d6839d9272d5b222a00baff8cd469a8e9ad185
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 7KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 def59b7bb623d2c77a4f98d9a323dc8ba6b86df9eb9b80d82a4956172e5401c5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b4e460e0a59d9286cd65ed88734b3c8d3379ae06c4e1e7b1a71cf0d7b34d4d0e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 824ee2fa72ba664eb5b9742c9f2f60202326cffc28b5c2b95cc5d614a5ca63f2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 cf2a15d1d715100579efc9160c85b3ee74bbacd2da91ea701fe5160f71da7cbe
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9ac1642b8211844f26d7f0128389a511e620908d6f7305eee14334ed13e6cba3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8f105c987cbc7ed8baf482a5c46672cfe05f9269f65f698dc1545054409d4ea5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 65ed28a38e4231717e8df9708e686ffb1721129e4b67e8eaa3ccd7eaf7804ee1
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          sessionCheckpoints.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionCheckpoints.json
                                                                                                                                                                                                                                                                                                                                                          • Size 53B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          sessionCheckpoints.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionCheckpoints.json
                                                                                                                                                                                                                                                                                                                                                          • Size 90B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 446b8cb7773a4232a7bdbf8c3ed22f21d792f2e187938c76bdc06af25f27c42b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 911B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 85937a3f13e95b8797c12e53eeeae6287eb34b3d5530e893137e7f35b5d6a14d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ea1886705c8d0748076db1ac5d12a3e467f98bbb0c6b4d4f2d20702302292bd7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a659c67e2a09deed985b9feed72ed0f8dd2b49dab52db5f20ad99ecf111a63c3
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8e68e522004d6f0cf336b5d9eafa3289bff2971429c9e5a433951ce2234853a5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 911B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2b2d09607c0dda227795ae25b7f7622319909187b443b9ca94e8b7ea5ed27004
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c02a321514c2cea757e96dc4c911be80b10a8e77235d2404ff356802826bde1e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8382b16aa7238f2f2420829471ed517d083fd228d90a41f69c6456aa62fe43e6
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0476c4af05c1375927dea3383492214db97d457fc96afda94373dc90e6c8cb74
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 909B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 c0e0dc6dd3bc77306a365c5c3c4eccc7e7ab544902e46e18d86c505d26f04e1a
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 80d39fe6b031d9c8bf968a2e47dd7f1c9bb37fa3baf7fd414579cdd8f2f5e3e5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5a80136145ffa0fbf87b87ad2965c56ac90d70156fea8830338ae27763e32e03
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ca97cdb573c9f3199ef021fc66377b43de8d5517ad485ddf62a714cadac37bc8
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 911B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0aff98b6b3e3e661fc9f7a7dc6be21418ad9f82d0cee155fb2bc4cab52e28829
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0eb34a79eef84ac5f98dcf9d0d7d1086d65082c43b52230553196f8c02652c20
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9d74486468294038db0db6003f069d4362c652f8e8e1552372ccce1241a73660
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1fb94a8104884e44f860bce28e3d72ff3a6712989ad46067a9d3b625c2632623
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 910B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d8d5cc185bd10fcfbd77bbdce57926445a1723b8cc91e47c3d64cf0797494e8f
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 910B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3be692120c44ea138d8d4dae0438f9e09316c02137815ab94fe58a54f98c045e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e12941bb8e872afa334683562ef03aed7e8d87a54d2b1088644fe4b962c3ee3c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 911B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2f27189d1aa40a62daeb11fb52ec24a9ba45a4d1948a67190f44c78164ea6679
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 911B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8ec5f909d288e786d81293f6935340c560b4a4259a69bbafe26422772c8e582d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 bbe3dc9337f0000a7ebd1328c774277ee1295babb94ba44070bd092c7c6df244
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 251f8bb3c098d0908fa4ea0c3a4358f583a4fd57363c69ae0670b4350fb0e99b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b0ce95fe7eb32449ebbba8526382edc4c41c4cd777ac30f52ea81f8f6898ae5d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 909B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3ed36c11a80c99f3471f0e77cb9a374fcf04fbfe3f9e90339001c4bb94474f9b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a1422f89cb0bfc44a07d84a9530b1aa0a94cb3aee43be17d35c979d05a510232
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 911B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 7bcefe69781c90f2e47716a559889e36ac2acc07379d9361469d1f6164b39340
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 911B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9a86e7273df1c68815c1962876b0d7932f9de77334da16ff90a26921f9b2f01d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ce5db3e48662fcd93b6a3c711732a457afbf0457bf7edaddb60f4975cc5849f5
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 9c6dba22020f0ab2b4c5558afcbc5a2b25a56247906fd15c3b34e45592232afd
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          recovery.jsonlz4
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                                                                                                                                                          • Size 912B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 2a24b8b37167b6788e96348e94beca2f12b940cda0bea4fb470fb4b46aefa956
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          {ebd7664d-564d-4c41-bd0b-90c338826995}.final
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\default\https+++www.virustotal.com\cache\morgue\149\{ebd7664d-564d-4c41-bd0b-90c338826995}.final
                                                                                                                                                                                                                                                                                                                                                          • Size 74KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 8c028ab84102b2df6be58166d739588d3d14c9f3ccbfff105a016225232dd0ac
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 59254de52768a4c6a87d0a8e84a56ea437ba1c4988b8cd9e709962f282cb50d4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                                                                                                                                                          • Size 7.2MB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5c96aec11f9e7d6ae73d04c853f7ebb1189f0b702c78566a24e577f1ca7b455d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          02d6d597-45a3-4478-aec1-039e6c8e2621.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\02d6d597-45a3-4478-aec1-039e6c8e2621.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 57B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          temp-index
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0868ac50fd18fb4056500320f472629de84fe7670ce97ec0044a841b06b9fa48
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          temp-index
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 367cadd4c86eb73820825f116e8fe7b494d73d923458ef10274b25028cfb5093
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 915bf7c68f9f525cd2a58800abe9b4679796bc35a3d170c4cd4c41b2bcd864c1
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data_1
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\DawnWebGPUCache\data_1
                                                                                                                                                                                                                                                                                                                                                          • Size 264KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data_0
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_0
                                                                                                                                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data_2
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_2
                                                                                                                                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          data_3
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\GPUCache\data_3
                                                                                                                                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          01b764b7-a883-4161-bb30-968640cdcdfd.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Network\01b764b7-a883-4161-bb30-968640cdcdfd.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 111B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Size 111B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fd306e831456b2752029041ca606f541a23a6978362592d15b42a0a7fc024a1b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                                          • Size 461B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 06ca84cea35cdd93885a0e5d53942a9c017f9d3ad593d30a630b75a999260970
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Preferences
                                                                                                                                                                                                                                                                                                                                                          • Size 132B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 15108d9d1d98e9869ce1dd71f0176c5bcfed0c0abbb8405d817a2c5398d83477
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          1e283338-d8a8-4a1a-b3f5-d77ffbe397ef.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\1e283338-d8a8-4a1a-b3f5-d77ffbe397ef.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 144B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 d8e41a7852c26e816ddd24e7a06a2104cc02cd37dcdc219a19d047ebf3184cde
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          index
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\c1214d61-6b50-440b-b2e3-39bc5db7fa31\index
                                                                                                                                                                                                                                                                                                                                                          • Size 24B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\index.txt
                                                                                                                                                                                                                                                                                                                                                          • Size 232B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 da2088cf7f45bb8a845ee49dfeddb494aee262058b60659ee243cdea7fbf8065
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Service Worker\CacheStorage\63fc7e4cfcc88165b53fe27bdbf48bdde7611b44\index.txt
                                                                                                                                                                                                                                                                                                                                                          • Size 239B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 a9a58f6f794979e5a9870d2e7e0e47e66c743a137351dc6e2d8d4787e2ad8c3c
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          CURRENT
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\CURRENT
                                                                                                                                                                                                                                                                                                                                                          • Size 16B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\Session Storage\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                                          • Size 41B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          a3af3fec-56be-4eda-873a-db17fd52b591.tmp
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\WebStorage\2\CacheStorage\a3af3fec-56be-4eda-873a-db17fd52b591.tmp
                                                                                                                                                                                                                                                                                                                                                          • Size 181B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 11527ab19cde6b02cbbb6ed1a0fed06e01bf6a7f4d0df43e7975e6365e8dce6b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\WebStorage\2\CacheStorage\index.txt
                                                                                                                                                                                                                                                                                                                                                          • Size 181B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 dd8b2b1a51478661d6987200babb12e246a76dec2ab44c8898766763cdec1eca
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\WebStorage\2\CacheStorage\index.txt
                                                                                                                                                                                                                                                                                                                                                          • Size 94B
                                                                                                                                                                                                                                                                                                                                                          • SHA256 b5a29b01dfd847ffaed8c7f9e86677b788fd37d654826aa10f885680b9447147
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          renderer_js.log
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\logs\renderer_js.log
                                                                                                                                                                                                                                                                                                                                                          • Size 36KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 ded699ed4b2ad9fa811ae7a6c47e1270c1daf5c63bdede5dd312890d92bd619e
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          scope_v3.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json
                                                                                                                                                                                                                                                                                                                                                          • Size 31KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 1d4503703153569a30dd419184968158389bd1cf6dbf8e991d99c7f501abb1e4
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          scope_v3.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json
                                                                                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 6622572637172b2968fc221fe48b118feed0948e3a7ec012e337df73ed68a0de
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          scope_v3.json
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\discord\sentry\scope_v3.json
                                                                                                                                                                                                                                                                                                                                                          • Size 31KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 da51d5bd18ae43558117f805c6ae5d9952d30af813fd8e2822cef4399f9323cb
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          LICENSE
                                                                                                                                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9244_1863810342\LICENSE
                                                                                                                                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                                                                                                                                          • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                          memory/1824-2031-0x00000000027E0000-0x0000000002800000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3084-3199-0x00007FF801DC0000-0x00007FF801DE9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3084-3195-0x00007FF801DC0000-0x00007FF801DE9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3420-4361-0x00000220B5200000-0x00000220B5201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3420-4366-0x00000220B5200000-0x00000220B5201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3420-4367-0x00000220B5200000-0x00000220B5201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3420-4368-0x00000220B5200000-0x00000220B5201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3420-4369-0x00000220B5200000-0x00000220B5201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3420-4365-0x00000220B5200000-0x00000220B5201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/3420-4363-0x00000220B5200000-0x00000220B5201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3220-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3210-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3216-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3218-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3219-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3212-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3217-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/4544-3221-0x00000231DB240000-0x00000231DB241000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6864-4414-0x0000000007480000-0x0000000007512000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6864-1838-0x0000000008EE0000-0x0000000008F1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6864-1808-0x0000000000DF0000-0x0000000000F7A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6864-1835-0x0000000008E60000-0x0000000008E68000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/6864-1839-0x0000000008EB0000-0x0000000008EBE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8060-4347-0x00007FF809B00000-0x00007FF809B29000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8564-7439-0x000001645AA40000-0x000001645AA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8564-7441-0x000001645AA40000-0x000001645AA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8564-7446-0x000001645AA40000-0x000001645AA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8564-7449-0x000001645AA40000-0x000001645AA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8564-7448-0x000001645AA40000-0x000001645AA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8564-7447-0x000001645AA40000-0x000001645AA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8564-7445-0x000001645AA40000-0x000001645AA41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8956-7370-0x000001A04A2E0000-0x000001A04A30A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8956-7337-0x00007FF8261E0000-0x00007FF8261E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/8956-7338-0x000001A04A310000-0x000001A04A311000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/11616-11594-0x0000026475990000-0x00000264759BA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                          memory/11616-11551-0x00000264759C0000-0x00000264759C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                          Download