f9765eb111379f5a8ee40304bd0d18e7550b03e40aa0f54c5bf3c543b5b669ad

Resubmissions

31/08/2026, 12:56

260831-p6hzmaan6w7

31/08/2026, 12:55

260831-p5z7hssdjb8

31/08/2026, 12:52

260831-p4akgaan4t7

31/08/2026, 12:37

260831-ptq5gasbme7

Analysis

user interaction
yes
max time kernel
134s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/08/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UMPSetup.exe
Size 27.9MB
Sample260831-ptq5gasbme
SHA256 f9765eb111379f5a8ee40304bd0d18e7550b03e40aa0f54c5bf3c543b5b669ad
MD5 5ce980b184e0bc975741d6da1b0a6a4b
SHA1 ef9087a5b38019b952a2bc873ed6ad01021fc6f3
SHA512 fbde8ed9735397f01268e21a9783ddc825b302f24a86114a037b3229763b31085496e8cb224654921cdf6d387ab143bf9a1c05e68fcc7363231f1d5115c4da5a
SSDEEP 393216:jQH856Vd0JTx2aIc6jPKelaVZpDT4OvhwJDnWZjvbIdYeIpAI5ZI8ThA3GF6kg:0HAJTQxfPKelMT7h+MDcHIpAIXAug
TLSH
T1A657333F71CB203CE06B963A7972A214143BBB21A4164C2697FDD89CCB664B51D3E7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2492	UMPSetup.tmp
1200	UMPLauncher.exe
2552	altv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\UMP Launcher\logs\launcher_2026-08-31-13-38-25.log	altv.exe
File opened for modification	C:\Program Files (x86)\UMP Launcher\altv.exe	UMPSetup.tmp
File created	C:\Program Files (x86)\UMP Launcher\is-7HE7RIDSRT.tmp	UMPSetup.tmp
File created	C:\Program Files (x86)\UMP Launcher\is-UXOO2ICY36.tmp	UMPSetup.tmp
File created	C:\Program Files (x86)\UMP Launcher\altv.toml.tmp	UMPLauncher.exe
File opened for modification	C:\Program Files (x86)\UMP Launcher\altv.toml	altv.exe
File opened for modification	C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe	UMPSetup.tmp
File created	C:\Program Files (x86)\UMP Launcher\unins000.dat	UMPSetup.tmp
File created	C:\Program Files (x86)\UMP Launcher\is-4KNOZO356Q.tmp	UMPSetup.tmp
File opened for modification	C:\Program Files (x86)\UMP Launcher\unins000.dat	UMPSetup.tmp
File created	C:\Program Files (x86)\UMP Launcher\logs\launcher_2026-08-31-13-38-25.log	altv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_705232459\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_705232459\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_974843328\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1532813643\_locales\my\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UMPSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UMPSetup.tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5956	msedge.exe
5420	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1028-1-0x00000000004A0000-0x000000000057F000-memory.dmp	innosetup
behavioral1/memory/1028-7-0x00000000004A0000-0x000000000057F000-memory.dmp	innosetup
behavioral1/memory/1028-29-0x00000000004A0000-0x000000000057F000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 40 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326535263396613"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\URL Protocol	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\shell\open\command	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\DefaultIcon	altv.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{9FF0A8BB-E6EE-40A3-8FB7-EE7FCF5B2BD9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\shell\open\command	UMPSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\shell\open\command	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\shell\open	altv.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\URL Protocol	UMPSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\shell	UMPSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\shell\open\command\ = "\"C:\\Program Files (x86)\\UMP Launcher\\altv.exe\" -connecturl \"%1\""	altv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP	UMPSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\ = "UMP"	altv.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2 = 8c00310000000000ae5c6d26110050524f4752417e310000740009000400efbec5525961ae5c6d262e0000003f0000000000010000000000000000004a0000000000265c5b00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\DefaultIcon	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\shell	altv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\shell\open\command\ = "\"C:\\Program Files (x86)\\UMP Launcher\\UMPLauncher.exe\" \"%1\""	UMPSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\DefaultIcon\ = "C:\\Program Files (x86)\\UMP Launcher\\altv.exe"	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\shell	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\NodeSlot = "6"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\ = "URL:UMP Protocol"	UMPSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\URL Protocol	altv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\DefaultIcon	UMPSetup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\DefaultIcon\ = "\"C:\\Program Files (x86)\\UMP Launcher\\UMPLauncher.exe\",0"	UMPSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\DefaultIcon\ = "C:\\Program Files (x86)\\UMP Launcher\\altv.exe"	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv\shell\open	altv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\ = "UMP"	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UMP\shell\open	UMPSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\discord-481413044359135233\shell\open\command\ = "\"C:\\Program Files (x86)\\UMP Launcher\\altv.exe\" -connecturl \"%1\""	altv.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\altv	altv.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 020000000100000000000000ffffffff	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2492	UMPSetup.tmp
2492	UMPSetup.tmp
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
2552	altv.exe
5560	msedge.exe
5560	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
240	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5284	firefox.exe
Token: SeDebugPrivilege	5284	firefox.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2492	UMPSetup.tmp
4716	msedge.exe
4716	msedge.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe

Suspicious use of SetWindowsHookEx 31 IoCs

pid	Process
2552	altv.exe
5832	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
240	OpenWith.exe
1116	OpenWith.exe
1116	OpenWith.exe
1116	OpenWith.exe
1116	OpenWith.exe
1116	OpenWith.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2492	1028	UMPSetup.exe	80
PID 2492 wrote to memory of 1200	2492	UMPSetup.tmp	83
PID 1200 wrote to memory of 2552	1200	UMPLauncher.exe	85
PID 4716 wrote to memory of 5948	4716	msedge.exe	89
PID 4716 wrote to memory of 2136	4716	msedge.exe	90
PID 4716 wrote to memory of 5956	4716	msedge.exe	91
PID 4716 wrote to memory of 2136	4716	msedge.exe	90
PID 4716 wrote to memory of 2136	4716	msedge.exe	90
PID 4716 wrote to memory of 2880	4716	msedge.exe	92
PID 4716 wrote to memory of 2880	4716	msedge.exe	92
PID 4716 wrote to memory of 3320	4716	msedge.exe	94
PID 4716 wrote to memory of 3320	4716	msedge.exe	94
PID 4716 wrote to memory of 3320	4716	msedge.exe	94
PID 4716 wrote to memory of 3140	4716	msedge.exe	95
PID 4716 wrote to memory of 3140	4716	msedge.exe	95
PID 4716 wrote to memory of 3140	4716	msedge.exe	95
PID 4716 wrote to memory of 2220	4716	msedge.exe	97
PID 4716 wrote to memory of 2220	4716	msedge.exe	97
PID 4716 wrote to memory of 5560	4716	msedge.exe	98
PID 5560 wrote to memory of 3500	5560	msedge.exe	99
PID 5560 wrote to memory of 5420	5560	msedge.exe	101
PID 5560 wrote to memory of 572	5560	msedge.exe	102
PID 5560 wrote to memory of 572	5560	msedge.exe	102
PID 5560 wrote to memory of 572	5560	msedge.exe	102
PID 5560 wrote to memory of 2280	5560	msedge.exe	103
PID 5560 wrote to memory of 2280	5560	msedge.exe	103
PID 5560 wrote to memory of 1812	5560	msedge.exe	107
PID 5560 wrote to memory of 392	5560	msedge.exe	108
PID 5560 wrote to memory of 392	5560	msedge.exe	108
PID 5560 wrote to memory of 392	5560	msedge.exe	108
PID 5560 wrote to memory of 6136	5560	msedge.exe	109
PID 5560 wrote to memory of 5552	5560	msedge.exe	110
PID 5560 wrote to memory of 6136	5560	msedge.exe	109
PID 5560 wrote to memory of 5552	5560	msedge.exe	110
PID 5560 wrote to memory of 432	5560	msedge.exe	111
PID 5560 wrote to memory of 432	5560	msedge.exe	111
PID 5560 wrote to memory of 432	5560	msedge.exe	111
PID 5560 wrote to memory of 5896	5560	msedge.exe	114
PID 5560 wrote to memory of 924	5560	msedge.exe	115
PID 5560 wrote to memory of 3960	5560	msedge.exe	116
PID 5560 wrote to memory of 3124	5560	msedge.exe	117
PID 5560 wrote to memory of 3124	5560	msedge.exe	117
PID 5560 wrote to memory of 3020	5560	msedge.exe	118
PID 5560 wrote to memory of 3020	5560	msedge.exe	118
PID 3096 wrote to memory of 5284	3096	firefox.exe	123
PID 3096 wrote to memory of 5284	3096	firefox.exe	123
PID 5284 wrote to memory of 3012	5284	firefox.exe	124
PID 5284 wrote to memory of 3012	5284	firefox.exe	124
PID 5284 wrote to memory of 3012	5284	firefox.exe	124
PID 5284 wrote to memory of 4356	5284	firefox.exe	125
PID 5284 wrote to memory of 4356	5284	firefox.exe	125
PID 5284 wrote to memory of 4356	5284	firefox.exe	125
PID 5284 wrote to memory of 4356	5284	firefox.exe	125
PID 5284 wrote to memory of 3344	5284	firefox.exe	126
PID 5284 wrote to memory of 3344	5284	firefox.exe	126
PID 5284 wrote to memory of 3344	5284	firefox.exe	126
PID 5284 wrote to memory of 3344	5284	firefox.exe	126
PID 5284 wrote to memory of 1688	5284	firefox.exe	127
PID 5284 wrote to memory of 1688	5284	firefox.exe	127
PID 5284 wrote to memory of 1688	5284	firefox.exe	127
PID 5284 wrote to memory of 4424	5284	firefox.exe	128
PID 5284 wrote to memory of 4424	5284	firefox.exe	128
PID 5284 wrote to memory of 4424	5284	firefox.exe	128
PID 5284 wrote to memory of 4424	5284	firefox.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\UMPSetup.exe
"C:\Users\Admin\AppData\Local\Temp\UMPSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\is-R6OQT7ZM7B.tmp\UMPSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R6OQT7ZM7B.tmp\UMPSetup.tmp" /SL5="$600EA,28083041,855040,C:\Users\Admin\AppData\Local\Temp\UMPSetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe
    "C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Program Files (x86)\UMP Launcher\altv.exe
      "C:\Program Files (x86)\UMP Launcher\altv.exe" -customui https://cef.ump.online
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2b8,0x2f4,0x7ffcac67c188,0x7ffcac67c194,0x7ffcac67c1a0
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,12546922572502033755,7090689688557444633,262144 --field-trial-handle=2916,i,1694839453473027177,17663704538218458111,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,13609555263139845298,742720557534169077,524288 --field-trial-handle=2916,i,1694839453473027177,17663704538218458111,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,17967357315812713048,15305409526659113520,524288 --field-trial-handle=2916,i,1694839453473027177,17663704538218458111,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,6130758022873250310,12076804527982912635,2097152 --field-trial-handle=2916,i,1694839453473027177,17663704538218458111,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,13587384373138871445,14755784652308024823,2097152 --field-trial-handle=2916,i,1694839453473027177,17663704538218458111,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,7630647467161168501,428260261325420061,524288 --field-trial-handle=2916,i,1694839453473027177,17663704538218458111,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffcac67c188,0x7ffcac67c194,0x7ffcac67c1a0
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1676,i,1514415017084944282,8210980411766704606,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,16969899738858243740,13812327020405956068,262144 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,12845772994804419214,15723138763098149958,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:13
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,5348563787770407568,13638487224713848303,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,5348563787770407568,13638487224713848303,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4792,i,10769443590418870895,4219455647016004128,2097152 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,561582080978866054,2654755378531245051,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,1347809356197876804,12044362962129162634,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5480,i,16137820724479547154,6467302717825077125,2097152 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,9095765280721678861,6746237780362310134,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8434661168963075196,9880150938688910355,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,1328311000591297066,15429257260309968161,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,8464524046040545868,16127600692909379900,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:14
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,15509314844964521726,11585001013554942760,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,16299611257982962496,12107817791435674022,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10158041389127042773,4169301367995773243,524288 --field-trial-handle=2204,i,5739618384702182276,12851791110407549281,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
    3⤵
    PID:6536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {4d1ccbe8-4349-41ad-b669-4bf5d60ca80f} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {c00e3445-a3ea-495e-88f2-6a856ad8a46a} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 27274 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {ecd40db1-8398-436b-ad3f-1a15fae9ebb3} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27274 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 3960 -initialChannelId {044d6aef-dcfc-4f46-855b-d476065c21fb} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4356 -prefsLen 34773 -prefMapHandle 4360 -prefMapSize 270279 -jsInitHandle 4364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4372 -initialChannelId {731343ed-ff6a-469b-a3c0-9bad57c4d143} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4852 -prefsLen 35010 -prefMapHandle 4728 -prefMapSize 270279 -ipcHandle 4592 -initialChannelId {2fedf7bf-eed6-4539-ae20-6052bbc0b04c} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5364 -prefsLen 32952 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5376 -initialChannelId {a67059b7-c944-4a04-afc7-c63697b7d1bf} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5380 -prefsLen 32952 -prefMapHandle 5388 -prefMapSize 270279 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {eaae9117-a6a6-41b6-b3f2-daa48829b772} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 32952 -prefMapHandle 5740 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {14b976ce-1eb2-40f9-a00e-092f366d1c33} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6368 -prefsLen 33031 -prefMapHandle 6308 -prefMapSize 270279 -jsInitHandle 6312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6300 -initialChannelId {8cdc150b-4d0c-4259-bb56-885eebf35c99} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6624 -prefsLen 33031 -prefMapHandle 6628 -prefMapSize 270279 -jsInitHandle 6632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6640 -initialChannelId {47f698c3-e844-4eb1-89d6-532892ce52d2} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:6192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6856 -prefsLen 33031 -prefMapHandle 6860 -prefMapSize 270279 -jsInitHandle 6864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6872 -initialChannelId {370d1095-7b68-49fe-afd1-21d0d327c19c} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
    3⤵
    - Checks processor information in registry
    PID:6200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5936 -prefsLen 33031 -prefMapHandle 7096 -prefMapSize 270279 -jsInitHandle 3280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {05d9fe05-5792-4e5a-8db3-335db62b1606} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5556 -prefsLen 33031 -prefMapHandle 5560 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {9f5cc487-6f8b-4f0f-bac1-0b4933db3928} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7036 -prefsLen 33031 -prefMapHandle 7020 -prefMapSize 270279 -jsInitHandle 6472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7028 -initialChannelId {09fce7ef-45c3-44b3-b2ba-0374898b617d} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab
    3⤵
    - Checks processor information in registry
    PID:7160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2980 -prefsLen 33031 -prefMapHandle 2984 -prefMapSize 270279 -jsInitHandle 2740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6336 -initialChannelId {d813f891-0d55-4c56-97bf-ad575f22a15c} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab
    3⤵
    - Checks processor information in registry
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6840 -prefsLen 33031 -prefMapHandle 6836 -prefMapSize 270279 -jsInitHandle 7008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7044 -initialChannelId {1b0c939a-77e7-41d5-a342-061abcb726ca} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 17 tab
    3⤵
    - Checks processor information in registry
    PID:2820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7028 -prefsLen 33031 -prefMapHandle 6736 -prefMapSize 270279 -jsInitHandle 6672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6792 -initialChannelId {df805b00-62f3-4f39-978a-ad0a23977fb0} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab
    3⤵
    - Checks processor information in registry
    PID:6292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6644 -prefsLen 33031 -prefMapHandle 2704 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5772 -initialChannelId {a38407a2-0e9e-43f6-acd5-09f789cce637} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 tab
    3⤵
    - Checks processor information in registry
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7632 -prefsLen 33031 -prefMapHandle 7636 -prefMapSize 270279 -jsInitHandle 7640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 7604 -initialChannelId {8ced3a6a-3692-44bf-9e1e-ec4a4018bd59} -parentPid 5284 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5284" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab
    3⤵
    - Checks processor information in registry
    PID:4112

C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe
"C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe"
1⤵
PID:6240
- C:\Program Files (x86)\UMP Launcher\altv.exe
  "C:\Program Files (x86)\UMP Launcher\altv.exe" -customui https://cef.ump.online
  2⤵
  PID:3056

C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe
"C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe"
1⤵
PID:4940
- C:\Program Files (x86)\UMP Launcher\altv.exe
  "C:\Program Files (x86)\UMP Launcher\altv.exe" -customui https://cef.ump.online
  2⤵
  PID:6236

C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe
"C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe"
1⤵
PID:6364
- C:\Program Files (x86)\UMP Launcher\altv.exe
  "C:\Program Files (x86)\UMP Launcher\altv.exe" -customui https://cef.ump.online
  2⤵
  PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UMPLauncher.exe

Path C:\Program Files (x86)\UMP Launcher\UMPLauncher.exe
Size 41.8MB
SHA256 5619d0ddd635c388ebdde8736fdbea6a16a40309aff1a1139d2ffdcb67138ba7
MD5 39bde86308ff2e1842fa8701ca2a60ac
SHA1 8437937dbdfbacf58499f44d37c3695b63885ea3
SHA512 48ddf4e5868f407a03106a03c5d1cefc48c8acab16a5ae0791fad2deb01e66cc6ac0e3ad31c5f54c2a1ee7de9321d173073039d6fe41221cdd0d29cae71f23b3
SSDEEP 393216:izBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMw:iaW1JhQlR7TtKeagPV1CmD
TLSH
T195A79C0773E50199E177D138CAAA9103EBB3B4161734DBEB329C03652F67AE49D7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

altv.exe

Path C:\Program Files (x86)\UMP Launcher\altv.exe
Size 17.7MB
SHA256 2bdabf937858fe03699ac2cb1aa4efad94059e116d920d1c47d497b57729fbd2
MD5 2dbe2858984c3121c2fccfcef57f2ea5
SHA1 3e9fd2612e55bfecca4acf17cde9a0b1d3836349
SHA512 e13da2287094d8ecd8c008b7d7e4e313dce3902aee21ca53e3aebd24f6c743878dda61c04f4e8b21178eb4137317b2b640266153726852e7de5f26b0269a910c
SSDEEP 196608:AQnnNwngO6MSC9J4fjPWggizceHH5bPr9iLW2T0NhSUkHEr5aVKaE7euUBUIpZsM:Aq86MKDTg0FELVTOcU9hBhIpZsz2TQY
TLSH
T1101723FA26D610BCC887C270D24A5BFEE1C5B8894C75683B7FCB1D415A32D46C8E6936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

altv.toml

Path C:\Program Files (x86)\UMP Launcher\altv.toml
Size 170B
SHA256 b43a315b4cc10feaaba2c46273607e4a6f2a9887111884c8cccab23bc1a23139
MD5 9ea5d0d9ace15445f1484d888d401f74
SHA1 5a519363086fff6b3b621b748d1cbdf180580904
SHA512 6d50ec78277417d416a08bf2dc153472973cf353af447d38dbe1108868666e1442405c61e2724776dfb8a00e4b9c98e5024fafb75dec8e97adea13da95c7ee00
TLSH
T17BC08C7D38F12178CC21980BC6BDA0622078196E61AB7676DA264A182291F946AC4CA8
MD5 SHA1 SHA512 TLSH

Submit Download

unins000.dat

Path C:\Program Files (x86)\UMP Launcher\unins000.dat
Size 2KB
SHA256 aef2efb66669186f6991dca4ad5bab82be4df4f8a51a38f42c0714ab282400fd
MD5 53821822afd30470522217deecf15301
SHA1 23b2015bdab78291bfc316088e4057db683df689
SHA512 f1d6756e31315d4ba70f1544017763cbd2c0e9858c6b8fa2ff858ffc297e106cb91cdfaca8fa90449b52a64e7c4921988ce3b85989ce523fe3e19f93c9143124
TLSH
T12341A1202BF566ACF7FB9B302FBA8A252A37F8055F35811D4055D3494836D5ACA39B22
MD5 SHA1 SHA512 TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\UMP Launcher\unins000.exe
Size 4.2MB
SHA256 d546f4f8ddb18c7712ef3d4d2acad57233bede3cb350ae365d5eb9c6fecdef02
MD5 b4387f1780b28998b4a9e8ed40f9ce4c
SHA1 42119681d1a4fb14143e878a7a147ce40932aafb
SHA512 3b3f21c4e081f300be199fd1c41938089d5eb188a863479d0467114554f8c2929b0f23e3c209faeaf8055d833ccab4b9098b00d6ca546e56841cb111769c7358
SSDEEP 98304:h9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Je333h:+ItJj90Z6RgKwZ
TLSH
T1CB168E13B389753EE4B71B3A883FA250583F7A213A26CD5B6BF4095C4F396416D2A743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 acd2e75ecd8821f4454b95f25b6238696055d0c89fbd322b8a9938926b5b4a59
MD5 0f5d9a6585a5113efebba87d6fd0bfde
SHA1 cc843c1d26278d967bc193e61985cabc1e7bf632
SHA512 385634179221f2f889a3dfb3838ff4e6e4c3d2d43601ee5bd255940160a8b587f53a02e9ab49f28220099ac3ab24775e0ea43db09eae144f0478f16d4ab0a31c
TLSH
T114D0A7372B1DB4D4E3BD82769722C3811BB6259265434705F304CC1CD9B40C012D2AC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f4bb41fb0d1a72f4f8edf193bedde26c0a3d020f211797aa9b010ab5eed2bf3b
MD5 70f859572882a14abea6acab9481aaea
SHA1 812270d68d207afdaa87d6f345b207f5bd4693f0
SHA512 59b4e5b40aa6488a4f9a0647513ae092c3bd5c8c6d59b7d16698e7f2e725a37b278503defbd577cf658f040bb32fcb58f54a9b141615b7992edf7c0d07a29f2f
TLSH
T19BE02BA5CC61EC3B08FD172890515746E70427572B428A0F3B3CD1098FB0A3F4689D5C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9ea068230e6defaca02563e1d74b6c384309d2258d6ff0bf967d9d673a9e9fde
MD5 320713bc794a7b762ee816f503418579
SHA1 5b09a7f96843b927df76fb333cdc6cc52247962b
SHA512 bb14a05a477aece5fbd0e696aee6ff276bdcc826e0a450387fbe0d78df066e0a6a03d13c8fdced3499ffef493919f3d947a2da87f213501622d6a6fdc63804c9
SSDEEP 384:NRDcrhTPf+CzdpRXvQO9hT91rRnkE5wlJnOIgQ0gob8z4F36IuHN:NRDctWCxpRX4O9hT9RNb5w2Ip07Izv
TLSH
T1E51372BE3B542E16FAC6D8FC240B5AB2677DF829C1D09F037BF5381A5239396291E110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 129dbabee495eeed7b487f4d6df0376121e4353421fbee2127520d002ad8b890
MD5 90052018587ddae3790243139f69f936
SHA1 b57611e67e1cddf727fe75177b2140f33342885e
SHA512 d71d454630b47e68e59a243e15b5acda7a036f65f28ba115bf43f9a909482bfe3682026b6251a63e39ce4ecf636c55023360d41633c16d6b0205f668e8464ea4
SSDEEP 3072:BO7FEGYGKo5dP4L/pL/L1XwL/dL/7FPwZgV:I7FEGYGKo5dP4L/pL/L1AL/dL/GS
TLSH
T19E443EF70951A01BCFA842F5E2033E3DD17B455D2CE1E9E9E6B84C912C35B21B6BDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 cefc30bfb8e617c5f9d9c77931c9562f7da70ba4b5d04f461a40ecdcfbde1068
MD5 0d44715ac9aed40564bfe3e27c987486
SHA1 012d63c8ce6518a60d61c5b26db45ce41a67ef10
SHA512 eb87f9c5f7b43b272337f2af9799aca842660f391159d580c796be5b23865c3db9b018755a9510901df827a99ab56c1efc1dfdf385d6c8ae691d24cbab954c51
SSDEEP 3072:T/fCU5mR3uRH+Hp0bs5hnTNbRnc4KBPNAzquVrZ:T3x5LRH6RnTbc4KYpdZ
TLSH
T1DF2519EECB682C82CE6B8770B0E0D9077E712183B68DC0D39944C5D997D6B8575E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 387316cd8511f806549e29a65506d57d728162a18fb4457d3b93e85b678fdcbb
MD5 dfa84bfb7e6a7697beed130eeb6ce15f
SHA1 99379b7249c5c725c2ffeb709d45adfe23a7429a
SHA512 6b63a057b6d37c63c3e2f7bbe536f81d4829a872c16812c8e81ab697ce6f99d805c20da3ddd1eb66fa1c59af2a7470ed1a033e41bc5984c177d4087cfec102d2
SSDEEP 24576:iPeOpE8ol4YdCuxII+zaSLANUus8KJZxoOKiKCCiJc+eLsz1CuaEnNRY:imeYdCu9mFAiusDZxoOKi7CifeL3x8
TLSH
T136867DEDCA6898C3CD639970B0F0ED477C7413C3F595C1D68898C684026BBC5BBAA769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

090fbabe5ed686e1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\090fbabe5ed686e1_0
Size 232B
SHA256 8e6acc47197aa58d29796fca5e547f526b92f01a900659c651654c7d5a74dee1
MD5 35756dd3e7e5b3c286b099a58f983a22
SHA1 1767a461e9480cf6987f1d03ccbae81e3f482b16
SHA512 bb108f7306825966c3c613d1fbd864eb2661fe6d5059d04ce8704ff57b99633478ecd06f1eb48b5fe5842a585ba92a712420015c3694cdd2a91a9698abfe7a17
TLSH
T143D023F76D6C5504C71C85F4C59F13E2C15370E50559C2F551FC54E735044607D05009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b1624aeb46daab2074ce277d273ebab915e6d5c029107c7ea095fc081800dfe1
MD5 1a3039ee5f11dee31bcc1128b347b5b2
SHA1 72510e46d72f892152fa5062d898d25b5163ac74
SHA512 bee28f6400741c86421c16ea23c9930ed74c7e2b7b9a4e8180c291f70935d72d9fe77f102b67b2b9cf1393b88de905b1d4c4cd149a582cb72dfd90262ec66d88
SSDEEP 96:YtzVN91Zc+C9rDXZLxjrCxRR50yjPMk3nN1:GH91Zc+gPZLJW1P3nN1
TLSH
T12BB1B23D82C6A791DF340DF3A7C42B8336787992888F6F0385984677A98F7D876D4429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d8d5594e6c06e70c013fa89d8c437bcbdd6a10c277bc5c9ac198604f7d683fe4
MD5 731c4623675676e6c15fdd8e6f940676
SHA1 4d0eb7346d86403abc232d0eb16705e975892dc0
SHA512 3a57128534d4a72a0234f43a079aa47cd6bd35f737e356de49115d06fdb581259dcb8c3f5d735330122cda4c7ca449870af307014ab828fe89a6d519eff1aee0
TLSH
T11C710B3DC2524B56D3710DF3ABD9970332B07AA7C92F1E4B59988577690DBE039E9038
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58779c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58779c.TMP
Size 3KB
SHA256 b3e7ba7af2f05edd95d02729384aa1d472641e8eaa830586220e51954b103d40
MD5 b94617f7ae4abfb358926d1ccef70493
SHA1 dd483503bbac0cdbc0ec1911a98a422c390fbfb0
SHA512 4978e36b87efded6be0ee7158db58c635e8044806c1c7835ca0be958c7c309b3b44ac76b14ef7708e84000330cdc341d83711f5bbfaced80da26b002f21d010f
TLSH
T1D171093DC2520B42D3710DF3ABD99B0332B079A7CA2F1E4B49988577690DBE039E9038
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 acabe48bf4aa58f956f93b65eebd4e9192f7d76e19ee5d0ac5ecdd5293a26e61
MD5 86b5f5fbe4966e3f9594def0ccb62cb8
SHA1 1b49e9ca0681fa79f2598906d969e678cdcd6cfb
SHA512 5431d06c54eb8ad7e14a80101154c373c2f80d428f2556fb57675644eb691d62976de3af8b53f3c52bd7f1215da7acb23916a30d17ee4bd6d99385f1d02857e7
TLSH
T1C0E0D89594D6C31E6920B8C352347709D1883852E6D5FD0B170088C47606401F78694A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 01a22535fe114072b5e4694d6bc027c1e5eac82cdcc2d6ac316eb8afb2af3100
MD5 9806991acb15fcaeb90c5e3fb94134ec
SHA1 74a0a93ff34dc3ec44e26c1a12e5553ba6ba863c
SHA512 f8df2ecbb1cadcc76c7cf8b161008ca62b30ba2ef6bd639fa5f55c30916b1db99efcf7619b5e79559cf7676ec98a62c80345632d02b4b562c8aabe323d348ae8
TLSH
T158E0262404CAC27DD556BCD382ADA70CC3D17C92B2CCB90B1B4C88A47101241A3CF290
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 283B
SHA256 d2fe08f0f67d874c2909f3705ff5702fc6cbeebec68e4ea09a2ad58234b2abc5
MD5 91bdd2081bc8de1e0e45077ea0c121e5
SHA1 0679052bd5049d7a6d2c74627befde21380bb94e
SHA512 385b321812b1491f6eaa58af8f081bee4a15e70f2f5c29aabdf9b24e6f9872b69f802345d99f8cca262aa0bb48d03e6a64797b3b3ac9fe8f410e4aadc946bd67
TLSH
T143D0C9F3090A317AE6424DF00285BED5B767F0A80AC4AB88D01EA15E1F018B034A7582
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 d0bc01882686b5bf7ee0c2f96b358f31e69667db7a5148932e622bc788ea52b8
MD5 d74c849397af9c89156adeb17046172b
SHA1 d663e27849aa18990e5ccdd27437c553e829fd82
SHA512 9178fc0cf8ef79aabd974ccadc7721cac85cfbbe2317283ee21defcb6ad5c7799ee8023ac9c8ea4aca1a209ab6b870d05fef368fe81c475fcd827c50ef333a11
TLSH
T1E5E0D87045DEC26D5544748B5294B70CD3A4785AE7CEFA0A1F0898A1B001004A3C61C1
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 c8b3cd166721d89a209c0481a7e151801c93d1ae72a8d9530fb08adc63c63f46
MD5 51e9000b3f14b1ed7b2a53cdd00a5931
SHA1 f74e2bcad1e49e782ef9bdba31d2360b2092a710
SHA512 ea030f7d78be0895c73010e409a6c003714ba1dfc9a2f12735a327aaab4feb72972ea663c2ddae83677e5ce15ef8916cb3aa93acd0e3bf6cc1ab368a17d5befb
SSDEEP 48:T2SLopFMatSaw/auUOt8BBivTRRaLouzRW+9PMboqQY78wZhBPljoxwB4unmxFwa:iSeMatUaAKBiLalWiPMMYTJNSruyl
TLSH
T16692C7DF0F606400D0D7ABF198F58C1A2F3E141C9BA365A9962CD1B18D712E7B737416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b8ffae74aac370183315ccc8bf80c88528350e239f6ed235c96db6caad69aba5
MD5 35279ed016f722affc5faa0be80d5d03
SHA1 c7355bd1fe95d2dd0b73e16e87afa720013191dc
SHA512 150d353a4cf6824d9f46a3f485dc1650a50d559a1068f9aacf82af62c818e6bdc73950a5aaf835a278d707420c95bbf6f66a759f8c413d9eec394dbfda273862
TLSH
T12931ACF743B4856E9A0096F0AA18AE2F8F2D0111436C7DAA85E4AE2793E3461E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 856b922bc61c88553c2bc201246a231d4b59bd2feb0579162a1bbae17e03dbe4
MD5 87504546ac1b1d4617a53c19bc23deaa
SHA1 4bb885f7433b780763059aa84e521d9a7515d0fa
SHA512 e4d8bdcac1768951645ee5eef54361ebb12e9bbac5d4fbb793af736c4fceaa66d2bf0c91f51658b83365f6a70ea6b447bb5ec16acc4606c514223ee485102247
TLSH
T10E71ADF3C3E9866DC90195F0AA14AF1BCF1D0955436C3D5A88E4AF5BA3F2471E141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 364835837d31487ded5c3588f2e97620ece80c436d122e064dda3f9d776f18aa
MD5 52bd69d31cbc8fb292e9ef587b2d5298
SHA1 4a6cb98ce4175f7031f7b0d7d5916adf3ba2f685
SHA512 929467fb6ab50d0b43df84fd18ec4368bbec5553a479d0aa619e85bff799bc28abb1a5726ca67140d1cc4f21e8bd09b1b1fd6a0e991c0431f832144e8cd79013
SSDEEP 96:uIEumQv8m1ccnvS2c7FSwf5nFXUZJWJ4g:uIEumQv8m1ccnvSH1Uw
TLSH
T17EF2EEFA07236606D98444F0E0005F8FAF1A404B47B6B6EC76D447E3F7A21E2B1B9796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 355B
SHA256 23d858c2b276def4cd8c72648dc0b9038eb1062d7f89f1361c093cd9a8508667
MD5 56b2fb4a94ff3fa3c509ff7459e45ea2
SHA1 d692a10bf7e76b96ecd6421a9b8eec7d180db6b4
SHA512 b7cf64f565cbd6e0738013192fe56940a1f737938bce2daaf8a797b75b2782fcec66ed27df7a77582bca29c3014e43a8e8d46690ac3291ce43b7d20faeb3f891
TLSH
T1D0E0DFE2C0FDF437203D587A0F457C8565BAE430928168F6D9BA837CA0968B7CB82026
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0ebc7212100cb80136c340271b3e734eb3bdfe18712cf33b66146a1acd185e41
MD5 db9d055354e639b5d199a3c1fe5a5f8a
SHA1 5557a5262ea7257be15ca559a3151c8ef776ebe2
SHA512 979715061fc19abf00d85826406af53a04a4b6c530de84bb3b71c18bd976a9d6097c7f32c5dbdd80745bdafd5043ab1e7649aa30fe2024f049a1d2d940a9bc5f
SSDEEP 384:sxZawpI5K/fFsitWvhuUei2p0/bC/5DZ+T:sXpWK/f9tYhuUH/b45Y
TLSH
T14172F7066A34597BCCD7D319FA55BF63D6F9556292904E449AFCCA1C00E6BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 98500491e72ac24eee8088fb1dd1fa57bfdd691cd78b96957018de7470dab7d0
MD5 f34959cfbcf82bc9dfd957f89a447ca5
SHA1 8bdbcf624def465f581a9174653d5d82f84fbb21
SHA512 b32c49a3dce825066fc1f6341f343b6ccac734c3ae043843fd59b6892ce528ed311bbda2d960e6d23358f7c296f3bb174db12de408d104c9c0bb6d2ce87d87d2
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+zx4Llv:wQAKq8y02yqEnjbWRmj1QWTu1jaK+zxo
TLSH
T164030A3B680CCB7E4FC04E9CED267E8A6DE8028BA698CD5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 3KB
SHA256 7373d969051d7f8f6c92ae5947dc993149c21a6e354e3873686d3c497bcb1e1e
MD5 a04fef3312725aa24bf7c86add4ea828
SHA1 843bf491b51fd0124c2fa6d4a155adfd5737ff27
SHA512 5c2ef90b90003841a4bcee1ddb1bfacaa41446ba3ff9e80ea42b41f84a9a801b332ebbc4bc6892e30bc32065551c1f80361f34460b6da6d6df5223a975743769
TLSH
T1C451F81F4E091E69D9E892710CFA18823378A5CE2658AC0752EED334F8D37345E4D144
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 2KB
SHA256 2a061234366491976bd68ba24d307dc8f238e9b0f8837a5230a84efc1450b699
MD5 b266f7684d6629d851e5dce7ef0e4573
SHA1 8f3d4a42cc0a8fbacad100d76d65279e97f4b168
SHA512 016471f16c9b6cbf13f4d6fa09b82c79781633d57da3bb7b904dfc2531f9827df58fe6cbf05e5a33634d472b85c4f3d30889e9e0b3e7f1229cf12d47d08a667a
TLSH
T1DC41A70D4DA1899FE864407205B36CA83370D9EC5B916B2758BC03356D0372E298B5BC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b447.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index~RFe58b447.TMP
Size 2KB
SHA256 62b9e13e6adf3ea5c6ed1f8d2d2e96d4e43670b12391c4729f0f766d37a30aea
MD5 61ab5c56b970f4e1457954203dd65047
SHA1 975db86e1aeba3e50e3e03486db6139b3ac83aa9
SHA512 8920bf8c50e0739dce51bc4bc8f4145ecfe21968fefba8847d64df9b52d3234f12b4bbcdefd456adde6e3ada73b325922a9022a30695c6e78ccfa354d68c6b4e
TLSH
T1734188864E818A1FE88440770EE3B8B87339584187157F5774BC5636A9617AE2E4E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 af90aa64df5f96632c7a25328c45dd8de49d09c9890b6e341867653652f362ae
MD5 48f4510cb9a3854872a7af416ad43482
SHA1 6afec6d821e06e45324a982f2fa0ca78ddd66747
SHA512 db8f32679db91ede10e3efb4c1b01fd429e0b0747c8a67596cc4c240ccd785da42892f9697feaef41115e5ae29faeac21038aab1ab1b2bdfc17e67e19405b14b
TLSH
T10EE068FE2DAB2824F86B83D21832806101423C50C544BCCF605EB59360A13143999C22
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 7309e15605eb3b8596ad4e27cc7497ff9cca8846fd3588167d659bc211034df1
MD5 4f2f0a7eba61f5d7041ea58138b53498
SHA1 6a8eeade81334f6186806bb76ba98b670287c4c9
SHA512 a00ce09ee7ebdc8341ce0c48016d36eee5d10d5f70b53525ba3d363ff161ab705569acd07d2d8ce27a5df96aeb44c1d24b9d76d5c81295b6e6d424dddbbf0024
TLSH
T1E2E0DF140DDAC2BD642664C30225E309C6A87827EACCBD0E2FA088606182904B6E71C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 213e9d095437edaea19c4196cd78c96249616a10258ebacd3be59b918132d2be
MD5 ec08dec5da9debe6b8809e5d6430a51c
SHA1 a84efcaad60ce7ec71cc1ecdd18a22383f536b5e
SHA512 d9cfc376a4f24e8dc7d6ca5ecd8314e83b130cfdddeb703623ab31f5e161a56b8c779d00a2ec8973f3e23285aef0f8f98bc2877d80331ad4d6fb89dcd833b842
TLSH
T1EEA002208B4D9611C98547F514B591407351AEFA11061303999CA7F98EE518057D5305
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59115b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59115b.TMP
Size 48B
SHA256 90ed854296e89688bbeb1062047f137efab5ebdd16990942a1385421b0b7c562
MD5 b007912342c73a84587fd5b3363c1c0d
SHA1 ecc7c6165adf827085ef28072ff4f759882f931e
SHA512 40c17d75d0b142fca6ff42cf2ee20d922418e78eee375877249560f83c72f665702ae00783df8a5234e425e4d74e7bc1127b210550aea42272cb3e13264cfcba
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 8KB
SHA256 9187da50c30032aa55050450b754c8f304f7766fcc2d1b285ac50c472f942a11
MD5 e36978ac8b706a731b9feb6ed24ca70f
SHA1 51e428e9cbc68835699fc621bdc774dad120f7ca
SHA512 1cc74b355de1cce6c7fe40194752b1c8c0f72a25f222d12b6924b6854c0316655234c629c9114786ec44c187766663ae8018698b848371d830d0c22af04f575e
SSDEEP 192:dOy3myk9GY2y+/OODVaOAnztiPcGTgcnh:Mckv2y+PaO+ztiPNgch
TLSH
T1DB02595AFBEB505DF7BF8E7518312499497EF9462C5CEC98009441C90D3AF88E8B1F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 fbb367af6a30bbff460dff35c9147da87c3eb88b4fb3d55968c5cb012122aca3
MD5 8ac3325a9ff368cd4a88f1dbc3eadc38
SHA1 47ffa1659a2a45f65fd7727a4ff392ba6b36b519
SHA512 0514120e2a3cdf199a97636ac54f583b7f624b84e1ffd1d0322b3d57b6cd5c1571ba14b06a150fb82ed2e0c013138743a8fcb05d21a0181f9c83e8ec7f13bdff
TLSH
T14AE04FB444DAC23E6555B8DB12A4A309C2E5B956F7CEBA0A1F05C4A07201155B3DA991
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 95440e5387ab8554d218fc959e93e85331870acdf9e8ba1160a3f653e29c66dd
MD5 05dae3198aab8bc3f5275bba78eb3566
SHA1 73b39f815d62325d2eba192535b5d230ca5e879d
SHA512 73f3e24116f4f094473722190fb409ae891d3c96294c2c95f8e1bab675770bd40e66263dcd2fe6d28e65e9ab93fba54273e531ccce6fa96c3ba19d630c6dd911
TLSH
T183E0D86119CAC32EA95BB4C75369E308C1A37913EACDB95A2B08945472465407387580
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 eb9a0bbea0fadd481fe93c8b336386894dc65da27ba28275c3ef0429f25f1190
MD5 9e2b1b815b62df80bc1a9b517506a34d
SHA1 9e82183303eaa4bca2d01610014b0bc7da03d8f4
SHA512 dac6fbfeaf26d7a2ebf5c40d0b489af0e916804ef232e005ec8fd67c0f8eadbcd39bdbdbe4fe929bad82b60532fc0116498f7a0012bd6b45f0ab3be5a7bdda6e
TLSH
T19AE04F7049EAC37D540AA4C743A5EB09C2E47C26A7C8BE4E5B084861B101244B7AE9D0
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9f95d6e2c30ea8c85be42e5b02f6fc12a02463557bb72180364e9bb80efc7a00
MD5 8bc3c57d17755c4ecebe176bcc3f398c
SHA1 1aad03657ddac41852482ed6fc68cacbca031744
SHA512 4e028e7a6c0c52825a42d0ee464f93d0eb3f9bee360535409e95b592f0aec8edd32a6fff190b798df3a85764116b180cb5608ba0a2d3265897c8bc3b4bba9abf
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5i:GZLVDJjEDPV0/ZdwPSm
TLSH
T145B2680232FA02423C7E291C92929B675A42F5A33059ED7F7BB900B54E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 e2337b585141f4588f30f90ffe9e653dd8eb2d46c91410d0f0669f1089815058
MD5 95477626c6c215244b847604a64efdb9
SHA1 c0a6ff5be04b2f60c0ca7cb4eeb833171dbfefab
SHA512 2ce167cf5fa4b3d022c4462b2426a3e18dea12ee36af9a9aa4675887a541277c8fd98d37641b01599d0438788d501f3137df692ecea10597c943e94dd465312a
SSDEEP 192:FvoWXswCSfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:aExzfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T18D24630A7B747001EDE7D9725CB080771A3CB16ECF22A6915DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 104KB
SHA256 8d10f6e12e6243c1da93b042abe43c681a42d30e39affdb9cbe0d4c28f61a878
MD5 495f43cba1cd14be69d8b8c684cb7edb
SHA1 b5a99b6e822b793fc6077dbda17ed9cb49c78fa8
SHA512 cf574a4a5790fcff2355cb20a0bdfb733fb0a4c315bca6350273ac0176bb5ed6a2e4f4851489913341fdb10ddf910ec61c6dd285a6ad0e6a53f81766e8ca62dd
SSDEEP 768:4qDAy92uugZ0lPXHOhllKBaA9W7PZsKpyjtjQ4j4JDrszwdOEmr//hTI+PogqV0O:1vH9UXFjjVg5D
TLSH
T122A32DFBAC0A91A6CDCD95B8D41BEF44407706218628DCE5AE3D08C37B78A12FE755C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 cc1601ae713cab2748b85557155d6e894ed73c76e73dc271d98888e0356bfcc8
MD5 583955896cc04bfe1d717d75e0c76a3c
SHA1 a1e45645bc3c03f88ab1bfd011bf3b2e88443d67
SHA512 888bdd569f80b749ece015792b16236dd335d8b987edbd4874a625ebec7515e31fadb5eddf567d7a11da9ee2db368c6bd1b912f6174e375a25da7c5e06cb944b
SSDEEP 96:6+N89+qvOxZaQgOXUZeDWXWY1lDDseC6AWVylrQEvWWV0tLYBB5N:6+y5Oq5AsylrQEus0tL0B
TLSH
T103220F647E02173BE90E4AF712798FD01BD2D581427766AEB621085D1DE2627C7C82FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4b20ae4b66f6c15f433b0f9b2efda16eb822d99c908790dd6d0996eddc542cea
MD5 4173ddf48d3746fe5112191fb3f5cb06
SHA1 e526de2d166d6d895b9513393bdf3229a7d2a85a
SHA512 25e25e6fc2836723a4a4e0261dfce035d3d18f6d248835672608f28849b689a48e3cc2331a17d05d285103c1020764b3be9c35d031f6fef631d460158cfeea9b
TLSH
T129E0DF10A8EAC26EA915E4C71124D709C3843813FAC8B90F1B0888A4B001100B38E181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 9a1ad1fcca2de60b3b0e43d5f93b3f26fac1f5893db3ba36b67d79e3b616f62f
MD5 f17768a40e0fbf10f6d89ff2e9295e28
SHA1 d12db065c247bffb1f8cda2e415f6b6fcd813f54
SHA512 06e2215106c47dfc2e0dcd647600dd06db7afe25d8b2dd24ba5e6d1477dce8ce4f8ca2591b489201217a60a5baa3da72b3262a0515fd0553ad71f98fca25f6dd
TLSH
T1A6215E56F320C108E58E823E602B9B751738E8428FBCEC5F40B970352E72E000E8B7E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 bce68d0f3589d5d278c5f014c77f7ef14377cc6167a64b9b63b26e348f3baeb6
MD5 e7af7e772bf2608e20f547dc4e27d544
SHA1 5df060a850e712de2f4394b3148dc4089bf8aaee
SHA512 387a3a9eda3607b44a83cd34801bb1ef41d5a05847f3431ba9d7de53b05fdb82fd4ca0dc4ebe5c2ea15038e36d245cb56c6e81fc4f96c8c9e87c2dd299eea247
TLSH
T119E0DF90B8EAC2AF9A5274C34165E74CC2953C22FED8BE0A5F098CA4B102241B38F1A1
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 84a826fd7f14e141493997912e95318b3e5d0360d20019ba59fb097b3fd408e4
MD5 7bf2dd126e0cc4c0d1231efb4c6fea5b
SHA1 1de9de808b3bd330c6121debac623e03122eef7f
SHA512 f724f0815a4fe54db476881444e1f9fafe9921726fc744f624a597d38bdd89fdf1ba6669f0a6ab7ac771f0bfef57668913f99d5e9fd1aea1a8a7634610a4f0bd
SSDEEP 3:MsEllllkEthXllkl2zEfl/OVKt/:/M/xT02zpg/
TLSH
T1704404047FC04415C500113140D1C3543374F4300D15574334D14433DCC75401C04400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 93e9e41d8bb327a6e0284424369eb9fb322ce06a44d994a259d5f89d2dff193f
MD5 a18c2507b8aefacce6d942492e7ec9b7
SHA1 6253adfb059d87de27acb9eaa74e918c55fddef5
SHA512 c97fabc6f8430c37e7f73255eeca3c6286b40858902c501c4562cc204a22894c430426e4a8106e6057cddfb13918fbfb064695b69b12dfe1fe48b3410e2989b6
SSDEEP 384:naiFFZcIy8Nv8TUNTUlIRfT+m3ek32nn9zTZu4JfbgGGkp3sUqsjhQXMRF9fQl0O:RF9y0wgkKekmBkGLVDXQ8j9f3g
TLSH
T1C3C23879DC54CA7FA8EE6B84A74E75128DE44237D5A889D8E7D80F0C40B619DA30BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 080cf265ba04e6f89ce515505f1f2c1fe76714692878227985d4a683da6450b1
MD5 4fa7b85d2aaf9f1265a7f0c0ee015345
SHA1 22623f8fe3c5a2772ec221e3ac4b32f3349f972d
SHA512 d90286b48fe7fa9af093416a56e8064512ab3c448aec479b61222e7c8a14bc7066aa80742930e05d92ba84aa9d5a1bb9ae2a6b098daadfdf9d8936ecfd957de0
SSDEEP 384:nMiF9CcmyWCs38NF8TUNTUlIxBPm3ek32nn9BJQIs4JfbgGGkp3sUqsj/dMe4KV8:3Fccps3WwgPKekmxrsGLVDNdMI8p0o
TLSH
T1AEC26B36E868CABBECE64FD9E74E6612DEE05267958889D4DEDC1D0D00971DC134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 47d42657531c468e08f23af62c7d6641455e31117c50268a7d672f286fef2d45
MD5 df58c16b8bbfac621844a7aac511b022
SHA1 8e1f58eebc597d3965415797dec630531dbf8c5f
SHA512 a7f58dad2a15bad7c61b2ffd02435557f6d2305e5fc4d47ad7dd9307d147c1c19f78646ce82ec695f423c6917713b59ca9176792707585ed964894e56be016d3
SSDEEP 384:n+iFOCcmyWCI8NQ8TUNTUlIRgT+m3ek32nn9zmZu4JfbgGGkp3sUqsjn2XHohVzp:VFNcpIbwgZKekm0kGLVDkoREd9+2E
TLSH
T10AE2283DDC548DBF98EE7B89A34E252289E44237D57889D8E7D80F4C80B609DF347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9bd459505376438d49465ec69352dbd70b1c78c4f93bc5deb711c48f448351c4
MD5 1f7d7ef8e59e9c57873dd8590695a7ab
SHA1 3cf48fd1864955380e65716f62670f3af60a6fc2
SHA512 5944dc4c341430060429c85bcaf06d89ccecf2e8f68d31fb237fe813933d96822fb0f7a949c7577d464c8eb4dd0f3a1eae8f3607dda6566da306503d3160d7db
SSDEEP 384:nriFFZcIy8Nv8TUNTUlIRfT+m3ek32nn9zTZu4JfbgGGkp3sUqsjn2AA6l0F7Iz7:GF9y0wgkKekmBkGLVDZA5g
TLSH
T1ABC23A71DC64CABBA8EB8A99F78A7653CEF44163998C8EC4EAD94D1C00971DD070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4513704a67fab3fe0228843d90197bbd2230ee8ee8dd200d4fcebfa478a228de
MD5 26d910c34b87f7a9a12fbf7cc091f7bc
SHA1 5bd30fad9abfd5772f5c6ea01e1c42f2ce0bd813
SHA512 4b547c465c2dc4abb5a46024941dd979b3f89dfa253eabc46b70d46a933058d4ea5b11bc07b43a97c0b7301e84a33a526d5468e12a3bff11c70b712fdd607159
SSDEEP 384:n+iFFZcIy8Nv8TUNTUlIRfT+m3ek32nn9zkZu4JfbgGGkp3sUqsjn2AA6l0F7Iz7:VF9y0wgkKekmukGLVDZA5g
TLSH
T159C24A71DC54C9BBA8EB8A99F78A7653CEF44163998C8EC4EAD84D1C00971DD070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 dffcb449e3658b5fc6fd9f3dcdd6f8de24c469b5a5cb7e76723a42a878e1eb70
MD5 2103a3b5ac0ce97bb72b8478763bded3
SHA1 9c6b8172fd040346809cda96242d697974e0f5fe
SHA512 9338f9d41e6439cafeb4ff6a71d0c74682225017ad475998b6c6181111db6a5ffb73f617a711c13c4d8cec3fefdae3bacce1293983eae24c0a7afbca401b3d8c
SSDEEP 384:n+iFOCcmyWCI8NQ8TUNTUlIRgT+m3ek32nn9zlZu4JfbgGGkp3sUqsjn2XHohVzp:VFNcpIbwgZKekmHkGLVDkoREd9+2E
TLSH
T110E2283DDC548DBF98EE7B89A34E652289E44237D57889D8E7D80F4C80B609DF347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dac8159893ef4881aedca00292968016b394cc63c203c6b86ce5a4581af0ca64
MD5 83747879597a0eacf5b322ef9fbc7328
SHA1 080d439ed463b8d1e4639bc667bb4d35b84433b0
SHA512 374d23c6160626a5a7d016c275d0ea7bccbfde19639c569525e2c1943ad4132d8a80a94e7ff02a848eea7ede1d2d468124d6ced567a98b4c6f815bf53bd1e83b
SSDEEP 384:n3iF9CcmyWCs38NM8TUNTUlIxBPm3ek32nn9Tix4JfbgGGkp3sUqsjn2iUe4KV8V:yFccps3rwgPKekmQLGLVDbUI8p0o
TLSH
T150C25A31E858CEBBECDA4F99F38A7682DDE0516399888ED8DAD84D5C00971DD174F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 ca9e66463f793b4c954696aa8dc4e1364b60cc2482b93caf03307177f154ccdc
MD5 ce9b5366865b20ff65446a08d2ba6fe4
SHA1 fe52af64d2e30992d59fbda57544e563f94b86a5
SHA512 970b9ba4f72358b3ec87e2a29922db1e48a5a680005ebc356936d31e04fe094a4d1550a1f635825d69abfc7b124b2b9ded7fb2fa53337c2bc3776f02bb0a613a
SSDEEP 3:MsEllllkEthXllkl2zEflZUt/:/M/xT02ztt/
TLSH
T1C9440204AF800405C5001434409183502375E4500661674734920422ECEA5400C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3b422bec6d157be35f5dbba8373199c83d1228c07cb8114f81e42d882e995c1
MD5 fd17ec7a694e753cc0ec21e1e1eb9a66
SHA1 c00e5a8a5ab1603529e2739e17314e63bf7197e7
SHA512 abde5c2428c34b65275c47a1ea7880de45c6b820397f1413b86099e6b837f2027c6bc452222f1ca0a215347988c8afec1413b3e4dcde792a9e03d1f1a668df2f
TLSH
T18A514EE04C381AD1D5BD0A6EB48B38FC81ECC726F5A4347D6C98E9994A7E65D348483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3da7b1cc122e38b313c6d52e9d2b57d0373f600e252a671175c95c2a0d01960e
MD5 d4e41af4630a6e11322a86e73baecd2f
SHA1 5c077b9aadac705dc9e2979ed8e64264d49656bb
SHA512 69db95caa3591c81e29943dc840dae154f8ecbb2a018775fe73b222ab3a0984ff9b73502e96875dee23c1a3605867e472e80a581cfb5b2de61c619fbd5610133
TLSH
T12C512FD04C381AD1D5BD0A6E748B38FC81ECD725B5A0347D6898E9994A7A65D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 f84dfe6d256ffeebcfaafa5949c471f8544f41abf0e7c6c3e7dd110f14938958
MD5 58004b24125daaf3306b81db3bdadebc
SHA1 3985da76b978ea392faa2b4697a315e066603fcf
SHA512 f631c796a638dee73f0c82ca8233ba6044edafa3d8ceb1ac5edbac532a562eca6702324a38132f551822a8f037201820853a86c2037740e2ca8eda39b53db630
SSDEEP 384:HkCjiO024YHDL84KKDL849B7SOEAd9KVRaAcP+AWRMATND:EzZYHDL8lKDL8CB7S/AmVAf+hRMIND
TLSH
T1D6728E7D5F003CBC1597C0E8C5F9929A8D18B7A7DFE6806D21583D0DCA98A69B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 88272050a9366aa1c5f46e31a8fba3e487031d0ce7fc8fd8b17f7d57fa72ccdf
MD5 b4824edc6148b449ed1d3ed458c3fc46
SHA1 7f74b07f530743b0fc23e52968667702b84d50ab
SHA512 4907a22b1218a1ff7d09a5e868a94d563270032dd40be479c75e8b5c457a24c88cce25c6ee1d9811806572ceab297cd1bb6e11f3caf1ff5ca027b2bccb041de5
SSDEEP 384:HXkRyiO024YwDL84KKDL849B7SOEAd9KVRaAcP+AWRMAO:3mZYwDL8lKDL8CB7S/AmVAf+hRMX
TLSH
T129727E3D4F003CAC15A780E8C5B992AA8E18B7A7DEE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3f8983f-5e9f-4e74-80f9-fbdba24bac37.tmp

Path C:\Users\Admin\AppData\Local\Temp\e3f8983f-5e9f-4e74-80f9-fbdba24bac37.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

UMPSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-R6OQT7ZM7B.tmp\UMPSetup.tmp
Size 4.2MB
SHA256 a6cb3b4552129b199db3ceaf70174c3e2a2df1d79fb32fa681fe2a5246d1fd1a
MD5 b55a7350e19e4abd7906816a63fcb4d2
SHA1 0b1d7aa215bf39ed94845646ef6dcc69fea3f6fd
SHA512 ee714842bfec2d2880bb14c855d9d0502d1bf859f81e7346d305ce1c7d7956bb2a160d9f2cab5756c2203ad58dedca4d2a66615836085128a40e22b7ca75ba3a
SSDEEP 98304:59SZUvl30aj90ZFcvdQ0hdgvminQLMj+Je333h:2ItJj90Z6RgKw5
TLSH
T194169E13B389753EE4B71A3A883FA250583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\AlternateServices.bin
Size 12KB
SHA256 790cbd6cc4750fb07c4aedfad20ca741e5f8c4dd6fbe75082a2f20fecc65ac02
MD5 e855ea654a9c0a8aa3974aeb9e78381b
SHA1 e2ec35b3858e176b08f5ba45724ea0a6ad050a03
SHA512 9aa61af24753257a8a59a871dc30b37c456c1be6e9c10714e2f5a73dc87f0267a025a9c8a6eec5d6be3a5ae64cadca591f514585dd31b973af3339b3ece7b350
SSDEEP 96:UpxUpiK41t2pGGyPGjGkW34G2vSeGyPGbGZNg4pZvX0If5t/Vd:Pv41t7N4G2fa4pZ8AD
TLSH
T1AF422BFB93B9A066F4718F7200A8718DCD77161D98944154DB1090EBCA962E0E0FFBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 455465a455735d47251ddf930a457171f68baedb565b60dcb1bc1376c51104e0
MD5 a78bf657dab628fed345a2d0eeea568c
SHA1 9be07a4a8c0e8eab8d27581dddd4cef4fc0301cb
SHA512 5ca5eaad180b5e637d29bf41dea476676fd0ec118b73a29b67974878543da9ff8df8abb533b84a4e5d3a1dd7c34b44b46776f7d0cb319c4f1f797f7034eb6ba4
SSDEEP 192:WoOv5zboHnZJgyjmOVR1d66Joz0dzgCl6mc0dz:WTboHZJgyjbPd66JozQzgC1jd
TLSH
T1DBE10CA4F628863BC409427BCDA21B460E35389AD84E7F15359D754C2D472DE3A8E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c5f0c82fa59d8af80bb7800f6cb7ebf76c8dea6ec2bbfa6d0bed95a0a3a65752
MD5 506fc008efd95aa177343f6c65a4c3e6
SHA1 e808b68f74c5e41bc5d6522bc6d60a59998d3279
SHA512 bb65d927a1647527c9cbe9060d2c2de56885344f61a5eef06a4c5c448f7fdf97009c987bfe10847468a9406c7eb0c200561f3743b6c04cc103f108a065002348
SSDEEP 192:4R1d66Joz0dzgCl6mc0dcoOv5zbonZJgyjmO+:4Pd66JozQzgC1jeTbonZJgyjc
TLSH
T161E10CA4F628863FC409427BCDA21B460E35389AD84E7F15359D754C2D472DE3A8E2BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b0458746f39f8c38c801663f6fafb0d079b6b2b5133b2763ff9960b348b5b9c5
MD5 bf4b3cb7504226052efced5cad6170bf
SHA1 d0c83debfa87c90f2b471df1d3b6041a1cbe3faf
SHA512 d7a89a08eecae4959ff6a3c6bc7d3051a13b54b861942bdd37df1b7c03346bd97a24e7ca0a83d18fa7c78549eade74f3a80d9d346fc4d7c4df894c5ed7d6bb01
TLSH
T14E217C8C79B94EAA6EC7F69C744011CE53454E0314871C838D52EF8DCE866DDB2AE438
MD5 SHA1 SHA512 TLSH

Submit Download

017d303e-0354-4f4a-99da-35e0c5c65e55

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\017d303e-0354-4f4a-99da-35e0c5c65e55
Size 2KB
SHA256 3d26e562e2f62fcd0c6a04b2ebf4709a59d877b52ac85d9adfbb505976aeb6e3
MD5 13bb89a605253104be873decf9ebb0c6
SHA1 3c4c340479897f4d4645fdc7555db78dbbbaa0a9
SHA512 26a21c43febb0ddc347bb141158cc314ece3e852ac6ae3630ad78ed65ead3c2a60a65a1343ccf3a741c12dffbd01cfbfdcd9670dee8830c2f3e95927acb37589
TLSH
T14F5166659160D87AC87DE30BD9213B838BF2140B408F190E5EE8AF0B257FD5E5359649
MD5 SHA1 SHA512 TLSH

Submit Download

15174892-8fd4-42c2-967d-249bdc0ee0ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\15174892-8fd4-42c2-967d-249bdc0ee0ed
Size 883B
SHA256 6482833ec844e32be8cc91dd5d48859534785c04f3195d615b2437653f16002f
MD5 851d39842dc4222f986c92ddfa4cc384
SHA1 87092e0372eb0f7cf82fe937a4b4435678795201
SHA512 8cb21806c9e7aa30e2ce0838b4b4e7409165f692f7100527d6d7da976176d8f8cc772ef652f99cf9ebb23561d4e7889738ce968590af80d07fa76cfa6822c5c5
TLSH
T19A11C081F534B5B2CC69D24F8B923B034BF47523C0CA55143D629B140D7AA1E675664F
MD5 SHA1 SHA512 TLSH

Submit Download

be939023-3ace-4a3a-ae9c-588a555f609a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\be939023-3ace-4a3a-ae9c-588a555f609a
Size 235B
SHA256 238592df8a46c7f5339b51a16344e5ecec0f1cbe14a8b45b25823cd3c1bd87a9
MD5 8b6d2c90a8c3ba8e9545dc6c3e17459c
SHA1 d7ad5fe22ca5716fabacb42e43e15e752adde565
SHA512 87cb567d11596e126e8d01c54923a97a256c85867a4f7c3d03c4f6c15c2e56f276f12d29898a1ab16c48907c3e8e5e3e0f696faf10539c797c3caab05838d51c
TLSH
T1DFD023D8149C677D4C180F17F0E57ACB30598D3718B59890ED9145789DFDECA41928DB
MD5 SHA1 SHA512 TLSH

Submit Download

d841f23e-586f-4d3e-b082-22ab9d8312d6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\d841f23e-586f-4d3e-b082-22ab9d8312d6
Size 886B
SHA256 af0314ddac552d5314d07df1dce3d8421fa7c2f387f9a7db514e8f14878a24a3
MD5 53d5e4f5db607075fc3fa1633e92744a
SHA1 39e5febaca9fdf7199d2c8b20d0c25685afc67cd
SHA512 0889920ddbc72dcb306e0f4bde517e30e39c7e762daad10a9ee1943096bc2becb01e5e2b3670b8f0d8dd1aacfafe7f1639da068d39cf7908a78837f7a3f2c41c
TLSH
T121112381D5B476F2CC6AC24FC6E27B8786F4B133C0CA48003D529B081DAA11E679770F
MD5 SHA1 SHA512 TLSH

Submit Download

ea8a6ad2-8f0e-47b7-b1fe-c26892d53744

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\ea8a6ad2-8f0e-47b7-b1fe-c26892d53744
Size 2KB
SHA256 a12485c24b92c5448900034579f6e54ae0bab7a1a5f6a5a6ab630dbbe87e1d4f
MD5 7bb025c1365c36fddfddd5f36ed516e2
SHA1 ee46b24a1782188fd2012ddacdeb120bcf7479ad
SHA512 3874858af095ee207d8ac96df1a8baa0ebf9380e27abf9d17d2d15c8b05eb3f86af2a4714987c961207a59a2268b40fc108495233dd10829c459c65510562afb
TLSH
T1D441106835789CB64CDEE19DD983238E57A05A0300C61C432E51EF0C8DDA659376B56F
MD5 SHA1 SHA512 TLSH

Submit Download

f6352916-aaf6-46b4-b0df-7997cb5275a0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\f6352916-aaf6-46b4-b0df-7997cb5275a0
Size 235B
SHA256 afb9f107e893454bf0de0e94dbf8e40bc4363cc1e44a9be30b053fc73dceb8bd
MD5 08b093473226761256c27081c6702aa1
SHA1 c6729559e422fa1d95b322b7e621442f5926bfb8
SHA512 9da9c88dcf81a35fe7888a6d222785874e8f08de2f391d013f415d424815932bb1d0178412d58f84e21428481f1d7ceddd7888e85f724dfa01644e30a38021f6
TLSH
T186D0978028A8B36D08046F03F0A028DF31888C332074581096608A75D9FCAC80311817
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\extensions.json
Size 16KB
SHA256 9b4b1c7bc9bd6594969a23ef4a63d36717ba0e949da262f56dfab48f569db70b
MD5 29d476d0b2ea427ac2c2953e1f4975ef
SHA1 9fc553f0dfe21cbcc3975b18ef7c5de6b62f40bc
SHA512 0d1649c1eb45e505d3aec58ab81875c2433016b47bcedfe73d679733ef4fb744ad1f8ad22e2e9b34ff08d2cbf7c93f118bd380fb6cfc711822b06424687fd4e5
SSDEEP 384:2kI4vrUmldvUg8dhWC94zf96olL4HuL4PfL4HhL4H5L4H9t4ho:ZI4DRf8BX/4p6W40474Z4R4L4a
TLSH
T17772621545049EB8294EA79BAA367E02C37D533B60845C38F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
Size 6KB
SHA256 0efee6eca8a5cc65a4e3da66df6d471f85b65f47ddeaba538788b4daa57b6be2
MD5 5e1150475877dbded13c4c3a9ccc96ca
SHA1 fe63eb15d16f497f8e66a61c4073026a0563a92c
SHA512 628aaca946292ab09bbd42487538ecca219fdc90c1fe2e485dd375941b65d4d2afb6b028fea7b6c40a164df715db3bca1070142785307d478ef1a51318fc2854
SSDEEP 96:xHPu5UTURy4qGqjyfDfEjF1zSIuSSlQdv9jcntH+xiIgBw88H8L4cnKV1HBm:1u5hyTR2frEphuSS3+xi/Bw88vk
TLSH
T14CE12F789508CB7F74B6776CAC648C716AB2013B77BF68D250B95484054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 6KB
SHA256 b4232815df7436a474b58bd3380927b47867b54db7718fc12e547101005d12e4
MD5 ae84405779e50b4afe439123ea84a3ce
SHA1 0023e0a672552b3d9c052087d3af8ff43fa1d3f2
SHA512 da0949cdfeefb4af447a52dac23cdf41b733a7ac4af31455e930c9b16e5b6cac712ec835bc55ababbd32ab4797ce8db7c3e23ba21e72b4856be0683bd16e3042
SSDEEP 96:xHPu5UTURy4qGqjyfDfsX41zSASSlQdv9j0jFntH+xiIgBw88H8L4cnKV1HBm:1u5hyTR2frg4BSStz+xi/Bw88vk
TLSH
T190E10E789508CB7F74B676ACAC688C716AB2013BB7BF68D610B95484054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 7KB
SHA256 f715823f367582e7ca2e58050176a86243dfe38c40d17cd717a169806af3c1d4
MD5 ad6c306a082130db937b4b4cfdb49198
SHA1 7b64361c7659736f68980473152501fccd806c65
SHA512 3979610fe4b3dbe70f05b67d7d31ebc5c8ae3fe0c3969dd8dd5828c0ad4d3990f75ad44f8ecb3aff2f7031b7489092e49fd99f7a23162c0383bd5e7fcdf151d5
SSDEEP 96:xHPu5UTURy4qGqjyfDfEjFObzSIuSSlQdv9jcntH+xiIgBw88H8L4cnKV1HBfGS:1u5hyTR2frEp2uSS3+xi/Bw88vL
TLSH
T107E11F7895088B7F74B6766CAC688C716AB2013B77BF68D350B55484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
Size 8KB
SHA256 adf1d972445a770e561d6540e5a77db81cfb3f0ae1a6c8893429b3f002830a6f
MD5 e1e7a40c654d3864d614aec413eb6488
SHA1 2fbacfc324120d597668ef177fd1c7f8c44e197d
SHA512 0feebaf7beca078378bf87329b29460732897011d2d06469d161bc66fa35f59926e8cc87cfdee7a9c137269cb251468f394b761696ccb63e5f4b367c96aed927
SSDEEP 96:xHPu59TURy4qGqjyfhEjFObzSIuSSlQdv9jcntWRKKxiIEBw88Pn8L4cnKV1HBf9:1u5OyTR2fhEp2uSSGRFxijBw88nL
TLSH
T157022F789104CF7F75B676ACAC248D716AB2023BB7BF68D750B94485014CF3841EA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 10d0f3b195b82bd74e997fb9e2fe8668a13e2a788f141a336e0bef92d213d99c
MD5 156df4944ac17fdf5bfdd5e991cb5b11
SHA1 660c12e48bf1102e48974d035e88786afe6cb8fd
SHA512 2d3ecf368d40ef71bfdca3c03c772735fb299197487a0c9e3fab63540c9c9c0b96b90252b59b9d103430bc273bfd375894cd5f6852dd4d9c44a2cbbd83ec0192
TLSH
T1E641F857EC1A2CF21260D30650C80B9AE70FB4525FD4B8C4D2996F29D9BCE0273EE65A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 0a5a5e444c013a860f454e2939a402bac5be90da6274c67edae75a1c4c7e8240
MD5 b0329f165b615c02154b7b365bfed782
SHA1 9b6e788f806c5b755a7d0695e01449ec5b61f96b
SHA512 f8af54d97e67d9fc9b436669d2d5b2b403a6cf8f02f31e13920d149d2eb9707bc0129bd16c92a07862fedabf4a178dd39f38c8183839a7efcbc4c933b9cc6019
SSDEEP 49152:LXq3QWjgmKR7bgYYvUu7GwF1+B9/3Yli4o0n:Dq3QWjghPu7GS1+//3YC0n
TLSH
T142163AF824D1A257F3818037668563EF21AFD00C6467DD484BD966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.2MB
SHA256 25457d4b9a64afe14e1809401d92001152ba9ea83ac203c5b01f6f563f49db5f
MD5 6e59d939f5a7a68e82016c51c1b2e559
SHA1 cc7596b61ed07658d346ea29c2e1c838949680c5
SHA512 e3a9a647e2ace4e46760eda3d34f117e038c12e97b142cc940ea6f67a7d0dfd3675b933622d480f6e762540a6de9cb5354a7fb95c5274964fd3db7723cf294bc
SSDEEP 49152:YXg3QAjgjKR7bWrYXlFNGwF1+BXtKRzi4oYnw:8g3QAjgmdFNGS1+1tKRUYnw
TLSH
T1031639F824D1A257F3818037668563EB21AFD00C6477DD444BE966F990B8CEF9E05B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_705232459\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1028-7-0x00000000004A0000-0x000000000057F000-memory.dmp

Download

memory/1028-1-0x00000000004A0000-0x000000000057F000-memory.dmp

Download

memory/1028-29-0x00000000004A0000-0x000000000057F000-memory.dmp

Download

memory/1328-2192-0x00007FF716570000-0x00007FF718862000-memory.dmp

Download

memory/1328-2196-0x000002CDBB220000-0x000002CDBB68C000-memory.dmp

Download

memory/2492-9-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/2492-5-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/2492-8-0x0000000000DF0000-0x000000000122B000-memory.dmp

Download

memory/2492-27-0x0000000000DF0000-0x000000000122B000-memory.dmp

Download

memory/2552-35-0x00007FFCCDF10000-0x00007FFCCDF12000-memory.dmp

Download

memory/2552-40-0x00007FFCCBBA0000-0x00007FFCCBBA2000-memory.dmp

Download

memory/2552-37-0x00007FFCCDF30000-0x00007FFCCDF32000-memory.dmp

Download

memory/2552-51-0x0000011F6EA60000-0x0000011F6EECC000-memory.dmp

Download

memory/2552-42-0x00007FF716570000-0x00007FF718862000-memory.dmp

Download

memory/2552-38-0x00007FFCCC6C0000-0x00007FFCCC6C2000-memory.dmp

Download

memory/2552-36-0x00007FFCCDF20000-0x00007FFCCDF22000-memory.dmp

Download

memory/2552-39-0x00007FFCCC6D0000-0x00007FFCCC6D2000-memory.dmp

Download

memory/2552-41-0x00007FFCCBBB0000-0x00007FFCCBBB2000-memory.dmp

Download

memory/3056-2048-0x00007FF716570000-0x00007FF718862000-memory.dmp

Download

memory/3056-2074-0x000002C856980000-0x000002C856DEC000-memory.dmp

Download

memory/6236-2172-0x00007FF716570000-0x00007FF718862000-memory.dmp

Download

memory/6236-2178-0x0000013845F50000-0x00000138463BC000-memory.dmp

Download