phantom_stealer | b3217ca3543005ea9d318cda4abdc79af8079d9e1cd60c38e9c042bd8c0b6469

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Size 1.2MB
Sample260930-j71cea1gra
SHA256 b3217ca3543005ea9d318cda4abdc79af8079d9e1cd60c38e9c042bd8c0b6469
MD5 ff9f3795b98a500d318432e023a71266
SHA1 34eb9005ed730e136558e39e78c96b6a9b746bd0
SHA512 38a738003edc563ff5e268c8ad1dd058ae28c8f668dc6664db1db28255e196d7df059d24aa8932167588495cb143287064783872e56fcbef11422e5149cd4e44
SSDEEP 24576:Kx6/BQAV9DTP9WQPHyNo8iZIxfOfEg/RJ6gLsyfA9:peAbc0WoTtfEgJDLBi
TLSH
T1BE5512147678E727C9AA97F91A71E63907F99D4DA020D3164FE4ECF77D22F0128242A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.tesomac.com
Port
587
Username
[email protected]
Password
E-invoice123

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.tesomac.com
Port
587
Username
[email protected]
Password
E-invoice123
Email to
[email protected]

Mutex

CCHK0LMNATKAVEPNLL8E

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
ftp_enabled
0
keylogger
1
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral1/memory/3004-11-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1720	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4136-5-0x0000000008A10000-0x0000000008A26000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4136 set thread context of 3004	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\547f52f6-8d36-4044-90fb-a2cc94808d6c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6152_13435230025230390_6152.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9c15af8d-2af0-429e-bab9-2cf77cefcfa6.tmp	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6332_13435230025115887_6332.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1956	chrome.exe
1192	msedge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{9147AB5F-0A9F-489B-B765-79BD047D6CA7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
1720	powershell.exe
1720	powershell.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4440	chrome.exe
4440	chrome.exe
4440	chrome.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Token: SeDebugPrivilege	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe
Token: SeShutdownPrivilege	4440	chrome.exe
Token: SeCreatePagefilePrivilege	4440	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4440	chrome.exe
4440	chrome.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
5176	firefox.exe
6028	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5176	firefox.exe
3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1720	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	97
PID 4136 wrote to memory of 3264	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	99
PID 4136 wrote to memory of 1096	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	100
PID 4136 wrote to memory of 3004	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4136 wrote to memory of 3004	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4136 wrote to memory of 3004	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4136 wrote to memory of 3004	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4136 wrote to memory of 3004	4136	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 3004 wrote to memory of 4440	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 4440 wrote to memory of 3828	4440	chrome.exe	105
PID 4440 wrote to memory of 2508	4440	chrome.exe	106
PID 4440 wrote to memory of 1956	4440	chrome.exe	107
PID 4440 wrote to memory of 2860	4440	chrome.exe	108
PID 4440 wrote to memory of 2824	4440	chrome.exe	109
PID 4440 wrote to memory of 4332	4440	chrome.exe	110
PID 4440 wrote to memory of 3264	4440	chrome.exe	111
PID 4440 wrote to memory of 1096	4440	chrome.exe	112
PID 3004 wrote to memory of 4440	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 3004 wrote to memory of 4440	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 3004 wrote to memory of 2860	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	108
PID 3004 wrote to memory of 2860	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	108
PID 3004 wrote to memory of 1956	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	107
PID 3004 wrote to memory of 1956	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	107
PID 3004 wrote to memory of 2508	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	106
PID 3004 wrote to memory of 2508	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	106
PID 3004 wrote to memory of 3828	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	105
PID 3004 wrote to memory of 3828	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	105
PID 4440 wrote to memory of 4104	4440	chrome.exe	113
PID 4440 wrote to memory of 4840	4440	chrome.exe	114
PID 4440 wrote to memory of 4788	4440	chrome.exe	115
PID 3004 wrote to memory of 4332	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	110
PID 3004 wrote to memory of 4332	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	110
PID 3004 wrote to memory of 3264	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	111
PID 3004 wrote to memory of 3264	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	111
PID 3004 wrote to memory of 4440	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 3004 wrote to memory of 4440	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 3004 wrote to memory of 2860	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	108
PID 3004 wrote to memory of 2860	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	108
PID 3004 wrote to memory of 1956	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	107
PID 3004 wrote to memory of 1956	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	107
PID 3004 wrote to memory of 1096	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	112
PID 3004 wrote to memory of 1096	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	112
PID 3004 wrote to memory of 2508	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	106
PID 3004 wrote to memory of 2508	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	106
PID 3004 wrote to memory of 3828	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	105
PID 3004 wrote to memory of 3828	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	105
PID 3004 wrote to memory of 4332	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	110
PID 3004 wrote to memory of 4332	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	110
PID 3004 wrote to memory of 4104	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	113
PID 3004 wrote to memory of 4104	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	113
PID 3004 wrote to memory of 4788	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	115
PID 3004 wrote to memory of 4788	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	115
PID 3004 wrote to memory of 3264	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	111
PID 3004 wrote to memory of 3264	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	111
PID 3004 wrote to memory of 4440	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 3004 wrote to memory of 4440	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 3004 wrote to memory of 2860	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	108
PID 3004 wrote to memory of 2860	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	108
PID 3004 wrote to memory of 1956	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	107
PID 3004 wrote to memory of 1956	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	107
PID 3004 wrote to memory of 1096	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	112
PID 3004 wrote to memory of 1096	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	112
PID 3004 wrote to memory of 2508	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	106
PID 3004 wrote to memory of 2508	3004	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
"C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
  2⤵
  PID:3264
- C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf168c728,0x7ffcf168c734,0x7ffcf168c740
      4⤵
      PID:3828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1676,i,13631649091563422604,14973385956134365139,262144 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
      4⤵
      PID:2508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,16294976923176980908,12936536505673561077,524288 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
      4⤵
      System Time Discovery
      PID:1956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,7200813772451118988,9424652148960317125,524288 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
      4⤵
      PID:2860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2932,i,16628651368631853577,639179502475971395,2097152 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
      4⤵
      PID:2824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2968,i,7350716764294530172,12083837472907449998,2097152 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
      4⤵
      PID:4332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3340,i,14034321817357069861,8164257004122793647,2097152 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:3264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3372,i,2843781585666428542,12163382604442842083,2097152 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:2
      4⤵
      PID:1096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3868,i,5687732884607762610,6784257977218822083,2097152 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:2
      4⤵
      PID:4104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --force-high-res-timeticks=disabled --metrics-shmem-handle=4152,i,16858492288754005300,4399409997355318433,524288 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
      4⤵
      PID:4840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4140,i,7717339805195365815,733373843485767433,2097152 --field-trial-handle=1960,i,2783936100859489946,9703767198143169960,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:4788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5gxhfy0l.5zk"
    3⤵
    PID:5160
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5gxhfy0l.5zk
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5176
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2044 -prefsLen 27099 -prefMapHandle 2052 -prefMapSize 270279 -ipcHandle 2124 -initialChannelId {47dedb8c-57e7-4aff-80db-06f057a51751} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2120 -prefsLen 27135 -prefMapHandle 2464 -prefMapSize 270279 -ipcHandle 2404 -initialChannelId {8c9365b8-ce71-402d-9930-0869b8777509} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5476
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\20a6d0fe-0d57-44f8-b09c-ffcc9bf3ea01.dmp"
        5⤵
        
        PID:5560
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2900 -prefsLen 27135 -prefMapHandle 2904 -prefMapSize 270279 -ipcHandle 2692 -initialChannelId {315f57d0-f02a-491b-80d4-c02c30e56b4a} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5580
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\746b850f-e207-4e6b-8cd4-c4ed451921ba.dmp"
        5⤵
        
        PID:5732
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2968 -prefsLen 27135 -prefMapHandle 2972 -prefMapSize 270279 -ipcHandle 3224 -initialChannelId {c8dc70c5-87a7-4b66-9028-92f4652df60a} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5744
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\317e9ec8-0122-4e1c-94fe-4089a8db9372.dmp"
        5⤵
        
        PID:5832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3208 -prefsLen 27200 -prefMapHandle 3392 -prefMapSize 270279 -ipcHandle 3396 -initialChannelId {d83f1489-b7aa-4d11-89e0-1bc3116cac37} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 27325 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {21c422ae-b06b-4c20-bec7-7917dd994cff} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5936
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2328f989-f6de-475c-8fb0-e041e3d35ffb.dmp"
        5⤵
        
        PID:5964
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3396 -prefsLen 27325 -prefMapHandle 3528 -prefMapSize 270279 -ipcHandle 3400 -initialChannelId {51508ffe-dbc5-4eec-a731-392cccfbc796} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5976
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\482d4028-983a-492e-b845-f6b95f167888.dmp"
        5⤵
        
        PID:6128
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4184 -prefsLen 27325 -prefMapHandle 4188 -prefMapSize 270279 -ipcHandle 4208 -initialChannelId {187d9563-2c3a-422f-a2c8-f3c3edca3b7e} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5144
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4636 -prefsLen 34824 -prefMapHandle 4640 -prefMapSize 270279 -jsInitHandle 4644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4652 -initialChannelId {6e494530-63fa-4c16-89ae-3358b9482ace} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2620 -prefsLen 35012 -prefMapHandle 4156 -prefMapSize 270279 -ipcHandle 5012 -initialChannelId {1470141a-929b-4826-a364-e97a67b53e34} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4952 -prefsLen 32952 -prefMapHandle 4940 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {67279787-7cd5-46c2-98d8-d76105febd30} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5580
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 32952 -prefMapHandle 5200 -prefMapSize 270279 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {d97786a0-3057-4fbc-b807-aef66beb0ca7} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {90ccc92b-b8d9-4ee4-a131-b4497ed0821f} -parentPid 5176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffcf1cac188,0x7ffcf1cac194,0x7ffcf1cac1a0
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1676,i,9934806126380347622,11381845186194003027,262144 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,6552414642759200423,12443934387636403241,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
      4⤵
      System Time Discovery
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,14536835942155997098,36300708759748766,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3076,i,11918015103644868342,8707016065826864303,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3092,i,17324266144659386006,12163931051363708140,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,2563229707846490678,5559479084939502047,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
      4⤵
      PID:512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,4314757813883389295,12041442147044357892,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:8
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,3970613639683288060,18402888092815716944,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3884,i,15113492239167253705,11884063878631284028,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3912,i,11158865359653406961,14438427437430234288,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:2
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3948,i,5164172387634107761,14754089910102599077,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4012,i,3182100881524100926,15015466756571174565,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:2
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4032,i,11627800614466699803,7066350239772741482,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4044,i,17459600481709191279,7513291101007097939,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:2
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4100,i,4573837666629495605,4215668657546508109,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4132,i,10874858067754615161,14723295574921711442,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:2
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4140,i,16037009649190121065,146601890705485932,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4184,i,16090585216569187267,1870503897757368608,2097152 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,2949454132613899624,11232624005405869361,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:8
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,4800255256653774790,17388281613532718756,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,18333148732805632114,18237971626623618392,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14900116953762534901,7713887011282686703,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14900116953762534901,7713887011282686703,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:6152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x21c,0x220,0x224,0x218,0x228,0x7ff7531604c8,0x7ff7531604d4,0x7ff7531604e0
        5⤵
        Drops file in Program Files directory
        
        PID:4300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:6332
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff7531604c8,0x7ff7531604d4,0x7ff7531604e0
        6⤵
        Drops file in Program Files directory
        
        PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,5437982224168465176,8922570649588528977,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
      4⤵
      PID:6760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,2642512295414447448,11085244423941518903,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,14108476841415395436,234877843663484839,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,16396598465551167948,13217818051582869196,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,14063210628746478340,7457382311208088809,524288 --field-trial-handle=2460,i,2062537851667807798,17454345555541267068,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
      4⤵
      PID:5492

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 123KB
SHA256 0f8ba17a8261f52323b7144720e4441dfcc058855d37018aeba7197245f9e8e3
MD5 e279e03517c067d229cd0616f6c948b0
SHA1 a673502e801ad0f6f1124b2015bd4e0cc69a3af7
SHA512 31744454a6f8db937c732207ded45be26d0dd076e23622ac98a455d13e510e211a9cc968be5dcb8e7aaadcdc32a864ce7ecce0afee76f9bb10f8211582c8d988
SSDEEP 3072:YeFCnoyuXmLsk/YR7GJgVrbMpJdWwHj86h:YeFCt/YwgVreJdWwHj86h
TLSH
T176C358613B26417BEB49EEDB294329153ABE3397E6C086D4B7593080B0C7996135F0FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11604a58-3132-4c36-8edb-6562bd6963e0.tmp

Path C:\Users\Admin\AppData\Local\Temp\11604a58-3132-4c36-8edb-6562bd6963e0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8d872e1c-a917-4b8d-97ae-80c985fedf8a.tmp

Path C:\Users\Admin\AppData\Local\Temp\8d872e1c-a917-4b8d-97ae-80c985fedf8a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e6975f3-e275-461f-a8c9-193bbb8182a9.tmp

Path C:\Users\Admin\AppData\Local\Temp\8e6975f3-e275-461f-a8c9-193bbb8182a9.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_st3qq2r5.iq4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_st3qq2r5.iq4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6028_1943715923\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Crashpad\settings.dat
Size 280B
SHA256 bbbb833d25f86ba430a8dcf9ee6420e1d278eeba99718db303149c20405d0770
MD5 a44fb2147936d93a71efeea20f3a1407
SHA1 3db7a8f2cead29b6cf583d4c282f96bad843a0a4
SHA512 64f65eba0412c034fa1cdac93c9bd835a19f218adf1165aa56bb8bafdd0565d5b45c4f6c5c5f6b05d3bbab8ccc7043bc6ec5305ed9c944bee5f03bd1f3c2dafc
TLSH
T161D0043351C40451C5C53031141447411355D44340010341051533754CC001105C3010
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Crashpad\settings.dat
Size 280B
SHA256 9c2b8699062edb387fb6292453ba9fcd881bc079aca2d4957b6718c752f759a3
MD5 c9741c107d837d15fdc8b41adda73e1b
SHA1 e74a3054d10d94d9a68b82042ff10fdd432de890
SHA512 f3d601295e506459c54fb78245c1718b47ea27c2d382b5a0ff19ed9fbc9be82f89eccbf5ef6fa0662a64172e0e66bfeb38dd1f27a8337563aa50bacb9c34b1fd
TLSH
T1F7D0223BB3C008A2CBEE28B020A20F8A0AC2C8C2820F0300000F322E0CF000280CF8A0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 515441bf806c6064b18bb8fddcd6e25a87cc8f3c2ec4f9bfe39aacac2fc032c8
MD5 9fce8ebf1f88b3c645696f3d84696c0a
SHA1 04bc932837cb8397ed1378de59b5f8a9a2ef1dc3
SHA512 d4ab5fb6b20e200911e9493519d7b86e4df984d13f6083be7665d75b776e36cba6273fdffccd208f1852d190b4cd44cbc787caffb16b84ff2a4410933768c6be
TLSH
T1C1D02BEB3D950824D86F57F6947518A185017C94A945EC9A086CA18754B03626C33C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 373B
SHA256 97d0750555932ae3544fbd6a3f8f9cd677f9fa8e498ad4359f06af60684e1cb3
MD5 902c29143f5e58577ad34730c21cd845
SHA1 3360df869cb30bfd669cba3c4804a96fe38fdb0e
SHA512 e5b38522f1c6b2b99c70676360f0dfec604dd295a0cfdfa8fbab010c8525803af2610c6127c1066f06fa8d4a27e952eefef02b73311d728974da840fd83b195b
TLSH
T160E0C0F73DE30810E85F93EA943104A145403D48D900EC9E5C6563C300B0351683BC21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe598e3c.TMP

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe598e3c.TMP
Size 153B
SHA256 59a33c0de527ac4712f9fa13c769c50e168dc58489dd740276170eda2ab1b8bd
MD5 e8a38f1d5308065029c16fd7b43f3a8d
SHA1 c497be867fa42a2a88e08bf2efa33b86dd33416f
SHA512 d95d7c90cb8108bbbe5288b0110988bb08d36a5b4693a001d44c29103a58205372d7b8d579c2851a85279cecb9a34b3aeef899862efc3afef3e00b707df53d36
TLSH
T18AC08CFB2D550800C90A26E2803128A182226C888945AC9A482DB18360702327832C21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Local State
Size 4KB
SHA256 24e07558f15ca67706b92cdbd5dc2b6787203964d64135aba5f38442e654c589
MD5 50d5689ae12b66d7438232353dfcc9b4
SHA1 3bfda703389bea8c2eda6635180a69c4c761c9ae
SHA512 ae86aeae1be65611d23dc45148bc2d21fab6e76fed4d4089aeff68a275a7dcbf42e0b6ea904371eb562c5cbcfa44087902cca588768c5f3bccb322658ff61047
SSDEEP 96:tqGNk3sFfmGGzf1XwDNBNPdvvYYeSr0eUn+JRqq4a:EGNc/Ga92TNGYegq+JF
TLSH
T1FF8195716464ED6789D62A44748A36D38E7834B3D812AF98E5DC531C00FB71D3B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Local State
Size 7KB
SHA256 b0c805731875b04a0c499ec6d4d1976e1ea7ccf33fdb7b35b2ded2a63e27d2d9
MD5 43655228aa65b2d3ab4842cdedaa6de9
SHA1 09e1c1c0001ad41273ce94c245e9cd861861bae8
SHA512 a236f1197b654aa3c90249b72f8bf4cfbf627dff222600c123afcf170ab662864a8090f45408f67a918a4906d1229cb8702c0c3f42dd4dee548bf3fc39508f3a
SSDEEP 192:uupL8NJbGd1G6xoDUhL+gah5Hgq+JKqCmc8l:nV8NJCdEptzwJch8l
TLSH
T1F1F10776A474EC3389EA9644B5893B939EF424B3D4856F9CE5DC4B1D00A7388270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Local State
Size 5KB
SHA256 f78049c964f0766d4b0f3861635468e9cf1b6658500eb5fe6d4da813e2538e00
MD5 b532047999ed68977167231842eb790c
SHA1 a06b40e50ea314569c7b2fa4fa06a76895e55187
SHA512 085d5d8e8670e5d8ae7383afb487bd2a2180ee72f4bbdf8728297f83f1003054e7d90ed32ca56948bb86650b8bf4658de1a6cd113523b19fb895366ef9901b7d
SSDEEP 96:tqGNkIQsFfmGGzf58Frh/cInURoDotovK3DOBNPdvvYYeSr0eUn+JRqq4a:EGNo/GaiooDUwIuNGYegq+JF
TLSH
T1C2B195756474EC278DE66A44B4863793AEA83073E846BF9CE6EC1A1C00E77583746C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5971cb.TMP

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\Local State~RFe5971cb.TMP
Size 1KB
SHA256 fd473fc1d499b07b0260470c03f0806aa1097bbc497d5d96ea0b22253af8de22
MD5 30709c711d47a743209285a054788a11
SHA1 7af456a2f6a98743ca6520f23a20871bb4fc76ec
SHA512 9dd27fb3732a2735d4cd8ae23a3a973e4574ee520430567ca8317e4df63cd60ae40081862c006657ef5a5a00b4ea63f619ddcde47dbc1dae031a829e3447036c
TLSH
T1E331B471A8A43C77EC911795A28A3B630E302475C1676ECC62EC4A2C02F774DB52BC3A
MD5 SHA1 SHA512 TLSH

Submit Download

8648d68c-b4ec-4b13-b75e-a075fd66bb1a.tmp

Path C:\Users\Admin\AppData\Local\Temp\tewa4ej5.4i2\extensions_crx_cache\8648d68c-b4ec-4b13-b75e-a075fd66bb1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\yqfcjusq.q0f\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 3880eed3765de192572d9733ca6dbc7ee739e2e96bfd202563c703eb290d133b
MD5 08b742ec2df543770cde6b6d8008f126
SHA1 68ebb138ad601d552a3ff3abb77b7be7e497d165
SHA512 495dd81c7fb15c0046cb43225381ea99cbc85bc130c808402d5567863991c1311045cb3948671c18791fd28b3dd4b8c610f7491f23e23e0b3a05da2a82b246de
SSDEEP 48:e1SodOu1W6NNJ9zCNYTdLXuHaA4pt8SodOu1W6NNJ9zvY4gdLXuHaAr2m:eRfJo8uaPGfJvXIut
TLSH
T13091A1012BD61757F3F7EEB2A5737B119B3BBA0956184B0E108447481C7370899AEFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20a6d0fe-0d57-44f8-b09c-ffcc9bf3ea01.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\20a6d0fe-0d57-44f8-b09c-ffcc9bf3ea01.dmp
Size 64KB
SHA256 2b9312a644de83b13c6fc60942dda9d46fcc3d6dabfc014e713c81d8b728744f
MD5 6b770a0fd1d4a5c157304b82727cb6f7
SHA1 eda778bbb29c28831a43349b88cd752e3a5d49c0
SHA512 ea88d09e24be0a5cce9b2dcf0e04aedf174e1415d04d930ea1bcf8e4aa056b8d95d2f31462f7c681a35d69bf618ab4249218d4e0a081cc66642786c2da785806
SSDEEP 384:i5lPaE4H3m/Uqep5Pnpbzu4Lx/KKpl1fkyHPaN/n7g:ibaE4H3CmJx/lkyezg
TLSH
T10C538512B7E41862F8298A3469FBB3107BF7F8909793C75F1681567B1CABB506C30E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20a6d0fe-0d57-44f8-b09c-ffcc9bf3ea01.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\20a6d0fe-0d57-44f8-b09c-ffcc9bf3ea01.extra
Size 1KB
SHA256 36379ea1504b9d8356aad1bf0744d95ff90f49aa9fdbea51f8d03680ecf3f1b5
MD5 297f5a46d683e98d3d110f4250148e27
SHA1 22e04bf23fd12c2fe252eb7a1cca46be32551298
SHA512 5fa46b1e1a1260bbc1e8e084eb835a37f8f75889af4b879c9b3e7b282f0762ce47898966369c8060f18ab07123e2900f52e3dbeda1db5070bdf50efa2ab004b0
TLSH
T18C3174B782EC6D6289574D88773A1703CA9E772B05D21D0C34CD064C858E4DC92529C3
MD5 SHA1 SHA512 TLSH

Submit Download

20a6d0fe-0d57-44f8-b09c-ffcc9bf3ea01.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\20a6d0fe-0d57-44f8-b09c-ffcc9bf3ea01.extra
Size 3KB
SHA256 917e9fa0f19864b64a8792e63a10bc1c2bf032269370529c5089b8f71086f831
MD5 92d582d47e06277489aecbd3adc6dae4
SHA1 9d6fb68a213cfce7a618cce54ba2414bf96255c2
SHA512 5b0e7fa7caf2fc0b14709cc0f6d41895cf36b8fe62568e6e4e904c507cad784003fde9dd89b46fa7ced5394bc7aec78f44cb4f09fc98aa4fea4a282181384d46
TLSH
T1E2813032019CD8375AEF6CCEA3376D4D999EB35998622A8C90EAC35C05B8CF47386143
MD5 SHA1 SHA512 TLSH

Submit Download

2328f989-f6de-475c-8fb0-e041e3d35ffb.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2328f989-f6de-475c-8fb0-e041e3d35ffb.dmp
Size 64KB
SHA256 612ed50dc130b868cb76e6c80b25fad9a80fd3e4438ede83f0fbd7d1b762b602
MD5 8c7079cab28e3bfaae9cd6e258049636
SHA1 21425021bba657e5831897949c9b0e72a3428358
SHA512 a74150c95e12556b7396ac5db8cf46f3484db2b2f819ca422bccbf6ba26167605d23ba9ddde109b181f183ce6a411b82d9fd8acd76d71dbd9382813bee53bdb3
SSDEEP 384:BOPaLIpSVWPSVsSVwUnsfEGeDGKV0wcLadNFCOqJKIu/n7g:BQa0BnUGeDGKyrLadzCOBfzg
TLSH
T11153CB12E7D80C62E867863529F7A7243BFBEA91B76387DF4601667B1E633406D30E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2328f989-f6de-475c-8fb0-e041e3d35ffb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2328f989-f6de-475c-8fb0-e041e3d35ffb.extra
Size 10KB
SHA256 13cd746674fe46e0d57aa85932676b571630af3ca71d311ca6992ac92ed6ef9c
MD5 9a1aa97bcef10bd1afc08b5bcd9a62c4
SHA1 7f6e7ef1f4b672e7fb6b07c6c2e71bb0cc9b3d9e
SHA512 5029d5dc2f01c41158e775dccb94edc20666df7ddcd13c20c5ed8f05338a8518b480c677ffc2d34e0bb05e601c06e3c0aa24340c2ba13bcc0d86950763c74e6d
SSDEEP 96:S7WCCYTNeY6pw6FFFdW6H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7aicBvtILI5qh:ShCkuFLG7uvZ8+8LBxsPpwlTAfoE
TLSH
T1BE228353878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2328f989-f6de-475c-8fb0-e041e3d35ffb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2328f989-f6de-475c-8fb0-e041e3d35ffb.extra
Size 10KB
SHA256 a41ce7249af74ef3e613caa66456eb5783cd647c44789683d0f579f60d77d145
MD5 6263ef72301ffe7cadcff734bcf39a4f
SHA1 003fddb650af01e60e78e1b778a067412b830e1f
SHA512 55e7227cbea0bb9b8866b7631a9b28365a6ac3963022c254fcfd1867414b0c48447c0062d614ae3bafa34ac33d0a4c9089ec808572fc9b5af68c1cd90ae5332c
SSDEEP 192:ShC/cFaiR4pmnTYapdVxzPRWBHk4TofKNdalbAfoMbLaJX:eC/cFaiFz15WBHk4T3aGAMy
TLSH
T1C132E931091CD837E7D7BC8DAB392D36D26D7B1A10E6789C40CCCA89C1A58B8A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

317e9ec8-0122-4e1c-94fe-4089a8db9372.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\317e9ec8-0122-4e1c-94fe-4089a8db9372.dmp
Size 63KB
SHA256 c0498cece024d2d90a784257af56e5c1446509eda5d8e4acb496837b4b2b4cc9
MD5 b9095ef6fbc30730e3ca3247f13efe5a
SHA1 dbc8ce1a11bdc7f2bd9697a8e60fbcefad5738df
SHA512 fdfca0f06cb595e3a4de79df9b3b99c915f95b53319c15f11e9dc7d82e98b3649e50d1b207ad1008bdcbbf0e42fe1dfb6f0f5a6761637fa4849660ee07165353
SSDEEP 384:XnPaMuJRvSVISV1SVAUXziX3vsOF83Bgo9B0q9zdo2fj/n7g:XPaMusUi83Bgob0QzdoGjzg
TLSH
T1A453A752A79C0471F925CB30AAFBB7213BFBE491AB53875F0A0155AB2D77349AC30E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

317e9ec8-0122-4e1c-94fe-4089a8db9372.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\317e9ec8-0122-4e1c-94fe-4089a8db9372.extra
Size 10KB
SHA256 78a59fd7a5406fab2b3c688f26e1f55e7e79949254ef395e5f25dcffb933e6f6
MD5 569ad69b142c0b71867d420927d37d6d
SHA1 0d63371f7090f62097a003154b93dbf81ffbc92c
SHA512 c054994331608ace8957c42be71729bb711f4e58b5a5f15a8275b94fd10db8bb7b400493dce98bc2bd99641f880c4d649d82757f4c8734cee4bbc53727cb6e0f
SSDEEP 96:S7WC5TNeY6pw6FFFdW6H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7aHcBvtILI5qwW:ShJuFLG7uvZ8+8L8xsPpwlXsfoS
TLSH
T16C229453878724B79D4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

317e9ec8-0122-4e1c-94fe-4089a8db9372.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\317e9ec8-0122-4e1c-94fe-4089a8db9372.extra
Size 10KB
SHA256 d4e5594ca5e516f5cf123b453a69c204d77ccddec5cfc8f80daef4131548c4c8
MD5 274576de6ce0c72cd6e82b7a5ffcab52
SHA1 39e5f8ebcc023ba5362ad292e1574a9626bb87cd
SHA512 3147a1aed9efc9fcdff6bf5caccaf8e3dfcf7b221fdf8669b4872b73e11ec116baa188b28432004c464d3c4ce07ccd22539de279c0d328302e5e5fc16118c466
SSDEEP 192:ShQcFaiR4pmnTYapdVxzPRWBHx4TofKNdalPsfoibLaJX:eQcFaiFz15WBHx4T3aGAiy
TLSH
T11632F931091CD837E7D7BC8EAB392D36D26D7B1E10E6789C40CCCA89C1A58B8A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

482d4028-983a-492e-b845-f6b95f167888.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\482d4028-983a-492e-b845-f6b95f167888.dmp
Size 63KB
SHA256 9fc4c5f54128dfdb810859673981e607639267824b932b4879f222ca53ba9fbb
MD5 55dfa1f7f924b5b9228e3dc6d0866d00
SHA1 c09116186f77274d3b5b778b5c4f0f668e99a816
SHA512 8742ad94566a8de212a76e7b7acf6675b96db1ac6e5bb0a800d1f83cbd6e85d1a67b4d3fef27bce1d80bb092dae274390444c1f49845f2258e3af97483b06d9f
SSDEEP 384:lL1PaIMPSV6SVQSVpU6Y+KVDFckcwRkRSCCN1s9/n7g:lLtaIM6o+elhRkRCfCzg
TLSH
T12353D812A7D80525F9668B3468F7BB323BF7E5959B538B5B060055AF2DE3340ACB3E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

482d4028-983a-492e-b845-f6b95f167888.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\482d4028-983a-492e-b845-f6b95f167888.extra
Size 10KB
SHA256 bd221a8ced5c2c130532a82d169be196bffece9771a17ed813921f770e81ebf8
MD5 ad3a4324b1a5950bbe450fa2be4e4950
SHA1 6c97e87c1503da3fde38b297be17d631a39fb604
SHA512 19f191c9a6e109dc2daf2a1172a7eaf46c0cbf2124d2a5db5179b51ca302803ad6aae9ae556bc81edecdceddfae769e73d9425fe2deb243d589da45a4d183b94
SSDEEP 96:S7WCmZTNeY6pw6FFFdW6H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7akcBvtILI5q6:ShmpuFLG7uvZ8+8LPxsPpwlgLfoZ
TLSH
T1AA228353874724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

482d4028-983a-492e-b845-f6b95f167888.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\482d4028-983a-492e-b845-f6b95f167888.extra
Size 10KB
SHA256 88a9db8ec42acb235174421f740079dac3422ffc9218c90cd851178c054e8646
MD5 1ab7c26fe473b0bdc5cc99656cef881b
SHA1 d4086c4168eb684dc563681e89d4d87d9e1cc853
SHA512 d2788efe873fb7f796a1ccc86a1867082d73aa6c0e73501a47705cc587f40276df0c9ded59b46e25508560265788b9a21be1e884f250509af4607b3b05030c01
SSDEEP 192:ShmwcFaiR4pmnTYapdVxzPRWBH24TofKNdal4Lfo1bLaJX:eLcFaiFz15WBH24T3aQA1y
TLSH
T16032F931091CD837E7D7BC8EAB392D36D26D7B1E10E6789C40CCCA89C1A58B8A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

746b850f-e207-4e6b-8cd4-c4ed451921ba.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\746b850f-e207-4e6b-8cd4-c4ed451921ba.dmp
Size 64KB
SHA256 4cc7ed19418a0c6514e3d8740d6cfb99857fe93a67c09be8150fd0868b05b6f7
MD5 43531b591fd1dfff587bfa55da04c96b
SHA1 888aff3a8aa4e5c16b733fd3f2075e8fb0ab7aa8
SHA512 c61bf72b9ee57d786d1991564c76e562cc26b5a550a2b4ab53c11d93e03708e5604f2454df746b590e331190d76fd9cf1460c8d8e0f0397be82ede40ddf5097d
SSDEEP 384:vAPariwnSVcSVlJQSVvUgkfqeZirlGuGSVl8QNhw/n7g:vqariwS2CAiroujLZNhwzg
TLSH
T1BB53C913ABE854F1ED2987786CF7A3202BF7E4D19793875B8642926B1DB33506C30E19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

746b850f-e207-4e6b-8cd4-c4ed451921ba.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\746b850f-e207-4e6b-8cd4-c4ed451921ba.extra
Size 10KB
SHA256 257044bc421df91d3b30c50cfc2d006f2763ee8a35a2a03efa8801a4dd589050
MD5 07c2d3af5149de8d667383bb3c92994b
SHA1 08a0d7c925a23ee2dcda224c5957f0ae98010088
SHA512 89e637f5d7aed47ae8c40fd02a02bf8ef4f90fa6183bd78960e59793564f43ef74adeaeda74e5be4687d3a65c99fe145d6d81811ce25e81c68e6c33e0829145e
SSDEEP 96:S7WC9TNeY6pw6FFFdW6H0Rh7CsevBb1d0+YjMLlIrLlhTLlaXv7aScBvtILI5qwX:ShluFLG7uvZ8+8LRxsPpwlYVfo7
TLSH
T1F5228453878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

746b850f-e207-4e6b-8cd4-c4ed451921ba.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\746b850f-e207-4e6b-8cd4-c4ed451921ba.extra
Size 10KB
SHA256 eb7b315bf0147901de30057a750f1922da21497fd13ec21469e3acce77706ae5
MD5 fc320a95acfb057bd0e4e26282636e96
SHA1 dd844e823612e8ee959eb91c3cfd0995380d6c3c
SHA512 63880236756d6f1246db5038a06203bf223b61ea3dce983f55b9a6407e0ab2024b591bb459fa30fa922de7dc9571091a4fadb9aee01d258d2b5a77e1f0367fd4
SSDEEP 192:Sh8cFaiR4pmnTYapdVxzPRWBH84TofKNdalgVfo3bLaJX:e8cFaiFz15WBH84T3aaA3y
TLSH
T17F32F931091CD837E7D7BC8EAB392D36D26D7B1A10E6789C40CCCA89C1A58B8A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6a95400b49ffe6a8ff30d8f6c4c41fc9e1d2aecd3594309aeeedb9f1878d350d
MD5 edb360a1c43c79c2ee68b3a7a9cdb257
SHA1 2334c541c0adc88da54de2453757de6c72c26b73
SHA512 38c5f3621bc4cf7de4587729e3b1739255b936b0629481be74cdf694e594c5aca151b4a1c57949d4336856e34e70b3c3025f98925e0e0c3ae3b71458b0e59ead
SSDEEP 192:AotOv5zbowbyCzJyjBvyCS9d1d66JozGzgCl6mc0dz:obowbRtyj297d66JozGzgC1jd
TLSH
T19EE11BA4EA28463FC048523BDDA21F410F36386B9C4E3F2535AC65092D5B2DE778D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1cca0b1c2dc56788b30db12da578ff490acf6c70b6369f04601c3ed0ab92ff30
MD5 d1a188550749b56321aef32b238d3a27
SHA1 cdbfe68af2ccf65581d15a7957fe8d41321aec1d
SHA512 11b2decd62583bc032cea733924b6229b69f9a24e62098da509eab4ced01c552d035c1b26ffc49deda72fa5a97400b5d655da4b1af1750bfac516e2e9f4a214a
SSDEEP 192:JS9d1d66JozGzgCl6mc0d5otOv5zbo0ZyCzJyjBvy:c97d66JozGzgC1j1bo0ZRtyj
TLSH
T18FE11EA4E628863FC048127BDDA21F450F36389B9C4E3F1535AC651C2D5B2DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ed64eed59f5d6086c29f5a1ba1c46bb51867795630b784322d0ccd832a53086f
MD5 ae4c5f5fbd542590903b2ead0f2f2afb
SHA1 72d656f83eb9a29165b1d031276dd5c69e3c5173
SHA512 dfd9b48573afc15a583c646511020a5ec277011fd4924fc6e7584431d4021a2acd1c5da79edb163a2af616eed54d3ed68be5bc138510f78f80a46e79fe66ab97
SSDEEP 192:JSHd1d66JozGzgCl6mc0dhotOv5zbowbyCzJyjBvyv:cH7d66JozGzgC1j5bowbRtyjQ
TLSH
T19FE11BA4E628463FC048523BCDA21F410F36386B9C4E3F2535AC65092D5B2DE768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b72ab202587c4d2f19fa9dcf6fcd583e58e64148eee9c3a64ad8240f03d64706
MD5 9dd44099902aaad3a512f259182b95da
SHA1 d561b1964ecf18d8189fadc73b36d7fcb0737ce2
SHA512 e0f40865f87413012c6629edf136e0b0208a32151b6ba532d74bda104cd1b112aa2092595cbe989e7519f10e8b61266a3fbec07770e56daae8aa3b6486ccec57
SSDEEP 192:votOv5zbowbyCzJyjBvyrSud1d66JozGzgCl6mc0dz:xbowbRtyjTu7d66JozGzgC1jd
TLSH
T12CE11BA4E628463FC048523BCDA21F410F36386B9C4E3F2535AC65092D5B2DE768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1d40626afdae3b14d4f0581a62ce9ba87b6a22f40099329b0dff1dde54284ba4
MD5 690552441441fd15d239fd94da615673
SHA1 85de1e433cff0621e7a5f32eccf4c8099672c3a4
SHA512 c52cdd48b950a23e4ac6cbe9e0af8d7140792fe4af20e2d264d6e0c8cdff991cbbc8ccc2c88e0c88ea292e50ea3133555d836c721722fa4ac77adaf8adb0318f
SSDEEP 192:JSld1d66JozGzgCl6mc0dhotOv5zbowbyCzJyjBvyv:cl7d66JozGzgC1j5bowbRtyjQ
TLSH
T19BE11BA4E628463FC048523BCDA21F410F36386B9C4E3F2535AC65092D5B2DE768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2cd7c00cd0b4e8a778fc395667f2e1719cacf8c4eadedb19e245c898ab3dd4e6
MD5 5994852243fb73bd026f8528f7ae3e50
SHA1 b54aede78743853205e2c3ca015a89c5732aec31
SHA512 72f104534930eb7574250206d1b5769e45cb93405fee370df67222686fa9b5be55cfc430e742bd881c81b4cd65d3e08baf4e3c0e34178d3eafca774fda1e0805
TLSH
T1BA11AA6C3AF98E6A9D8BF29C74814ACD53518E0A64471D435D02EECDCDC1AD932AE839
MD5 SHA1 SHA512 TLSH

Submit Download

16e4f814-9eb3-47ea-a748-e7fc62e9dcc9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\16e4f814-9eb3-47ea-a748-e7fc62e9dcc9
Size 3KB
SHA256 2dfdcebe03c089409210c6a6a68a7301230e853e61aede8c63d7a3f448f012a5
MD5 1d5acfdda63a60185e83119c42014616
SHA1 b14c9f056873c421f53d66cc96e4136d43edb699
SHA512 de0f9e3fcaa6c29ee882198a5cb289903816706a492ccc2c9138eee6fb9998d7d39a095426468ac46b2c3840b34c20c083cec5e1f821013c44e69ad11327bb05
TLSH
T169614631157869338EE8B04493376EC59AEE33CF58470FCD257ACA6446A88D8578B36B
MD5 SHA1 SHA512 TLSH

Submit Download

2760711f-ca65-4f92-a588-1451efe97176

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\2760711f-ca65-4f92-a588-1451efe97176
Size 235B
SHA256 05cbf6017a523a0991b40cb98e1c6a12bd76747d4ae4e4928f1cd6edc072324a
MD5 af49edb1b5ac37b13f9d149c735a0598
SHA1 9c23be0aca0d664f77c3e5e1d4adee4aeffc569f
SHA512 936d7e8ceb41d6b2beefbd787f52638df5568aa76e84929bf199bd632f76ca37d6fa776b86bf08df3ae924cc05f3944818b386604a1fc080d93413b4fe9479a4
TLSH
T14BD097882888B7AD4C101F06B0F068C330A98C3710B0A810EAA245B8C9BCDC602A298A
MD5 SHA1 SHA512 TLSH

Submit Download

453ddbf2-f78b-4169-8386-f39fa39f4aa3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\453ddbf2-f78b-4169-8386-f39fa39f4aa3
Size 3KB
SHA256 ea3c909178979e26bf3d02bed9890767157ec440a64b17269f1f68ef77ca4aaa
MD5 a666777b6979ae7a29ef8fc986321269
SHA1 be68077d3ee3524820643340d287acfcebf34877
SHA512 cb7ec3184414060772c1312b40abbc1d53b94635d19d9becb6c294fc7f48c87662f50f655ff8d6e402e578817a0095619961f2dea66f71eef1a02ce8faaf460d
TLSH
T129614721156865338EE8B04493376EC58ADD33CF54471FCD217AC96446F88D8978B35F
MD5 SHA1 SHA512 TLSH

Submit Download

71e90dbf-b8d3-4fce-9c3b-65c7b11daf9f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\71e90dbf-b8d3-4fce-9c3b-65c7b11daf9f
Size 15KB
SHA256 373a524efa6af96c26f0b317de0a3c0c7b87f70052390e6c82f1420085a853b5
MD5 592b7b43be0b991f7806935f31285d24
SHA1 d406ff5367462da4e87fe9c86dbd0db58e284a4e
SHA512 01057bec60cd80eacaeef2c24c74fc017971503ed5d0bfcebe131440dda25643d0ac062fc5496ddb2775d8939c7ffa266afa9f05f4658552b2c0aeb5b142b6bb
SSDEEP 192:/0eadtjyM91FUjRXO1yBYNUE5t7u9Mq781uB5SbLRzxK7Oa7+SHzlIqNQ88G:ClHUR4T5FYJZbSbLRlK6a7+SHzVNQ0
TLSH
T12F72D9562420457B8251F3A994F8BFC3E6F628CF4C419FCA9BE4BD086DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7271600b-5135-4b45-beae-4277c84a8bc3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\7271600b-5135-4b45-beae-4277c84a8bc3
Size 2KB
SHA256 699a26b00cf0a44732a77bf2f85ed65973d986a1e8da27426e066a34df2b204a
MD5 81a7683903521f5b7050426fc5a5c239
SHA1 19f7f04c1934c2e4e335df8e3e4d33accd1fc6f0
SHA512 6b9c0112122e4e662702280542ffec9b98639d4317f8ae49140c92333c0de2fc4cf8ff5669fedf25934018862cf46485c60faf645528b55ab8b26c243f1c0a9d
TLSH
T15341405C75B84C365CCBF698D492238E97748A5340C65C836E51EF0CCDA669E336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

79aac2a7-74bd-4c60-9875-1f518355bf9e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\79aac2a7-74bd-4c60-9875-1f518355bf9e
Size 896B
SHA256 22a5dbafb9abb50cf31e05cd96a7c889b8ee50e49666f0c1a1e2aba1405c80c9
MD5 ff48a6126e9ad1e963f624fd9d4c87d5
SHA1 55cc591349994a5eed9085ff114b0afdcd8bd441
SHA512 d0d39891df1a35538de7f988016edb0d45cc151529d8eb91ed4186fc619d3f754186dc40c9144f0dbd0f2957a874018d6bdc3be09fe57e24d37bbaeba2d21066
TLSH
T15C110080962075B29CACE29BD9A07B8687E06223D0CA4E143F645B184DAF91E977660B
MD5 SHA1 SHA512 TLSH

Submit Download

7d878968-5e29-4de4-b454-d205e49495b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\7d878968-5e29-4de4-b454-d205e49495b0
Size 235B
SHA256 74b4299cae5b97150ce2859f6049e22c7cbe699c9b9f5c23356e039db147a97a
MD5 d5312f5ac4f92067938f67b220be8a25
SHA1 ed47074c886d234acfa0b6e51f5bcd331b25bb81
SHA512 d4c7eb30f14639c9a6e92933753f517c41d18cdfbc4d9b2d76c345eeb5992fe727a05bb52f1c4ef7b2d47eeb0fd28f45bd30d8ffcb1af3225f3f77822dd79084
TLSH
T15ED0978078982B6D08080F27F0A039D630844C3320A1A810C6A141788EBA9C80161817
MD5 SHA1 SHA512 TLSH

Submit Download

d035094f-af61-45d5-b7eb-9cba46e1422c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\d035094f-af61-45d5-b7eb-9cba46e1422c
Size 3KB
SHA256 83960834ea96875dbc3a55f9bfdeedf3760b3058b9a64c24f4532583ab0de46c
MD5 6d07a8f4d5a3dd0a5f191221d10be40d
SHA1 f25bd24a6fb01b703ab134421c3761458c12578a
SHA512 b15ac64b3aa780e691ac3980db16bd6b507bfdf41c81784afddf4f9d5641666be3e71d7c34624261019b3ec8422f97ef3cd2b1259b6f0f288b71896189c0156f
TLSH
T1F5614421166875338EE8B445D3376EC59AEE33CF58470FC9217ACE2446A48A8578B36B
MD5 SHA1 SHA512 TLSH

Submit Download

e1c00bc1-1588-4158-a5b5-b7dd1c81b223

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\e1c00bc1-1588-4158-a5b5-b7dd1c81b223
Size 3KB
SHA256 94d58a853658161cfbf89b4c93858c2dd959dbfec7facfcb28681f016b22f1c9
MD5 258458c855f9e2ba9e98e915bb852f30
SHA1 81e6ee5c687a5de6b2c11828284decce0a7f2dac
SHA512 3a0f149687c8cde3be00b8051561ab5259c4c8ecfa9275ed4a6fc5f75bc3c80385a2f93395efcabf5402b0bafc865559ecd79b9d249287947af2c17cdc6bd65a
TLSH
T166614521166865338EECB14593376D858ADE33CF58470FC9217ACD6446E88E8978B36B
MD5 SHA1 SHA512 TLSH

Submit Download

e96bbe68-143a-43c6-9309-85d62f5d2cc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\e96bbe68-143a-43c6-9309-85d62f5d2cc4
Size 883B
SHA256 01e3bb2e765660f8eab56e97cdf3d00c6b6134ad642f2f75ad52888ec3f9684d
MD5 3eeced24c59083d5f6743c81357ee1ae
SHA1 fa05d8809d871f262bab70a94a6ecc4b5cb71c9e
SHA512 625227e08919a90ffe0333edd6209ea965e2ea490d8d61e223b3b59538c3a3ee350305fd85f9baa06a0361350dff9fb75d38dc054afe3b338aa15ab027c0f035
TLSH
T1F9116340923175728CACE28FC6603B4687F46633C4CA84143EB50E144D7F51D936A70B
MD5 SHA1 SHA512 TLSH

Submit Download

eb71a4e4-5f30-4b90-9e06-512a18874786

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\eb71a4e4-5f30-4b90-9e06-512a18874786
Size 3KB
SHA256 8ed8a88fa26a283df69fb3277c2cf36c3b782023dacb58b6f8dabddfc8e05780
MD5 8bc69d3a1ce103b1a7bed7b5b3a0a575
SHA1 484002c978badeb46ecef0f41272286ed0c299fc
SHA512 cc658766a9455106307976d4124359548e9d6e9565f488dfd2bca9916d19ee8f502bdfe1edd2dacb94a8e0cb259430a50ee60e209e26e54f6a7b814ab23c10ff
TLSH
T1BF616621156869338EE8714493376DC58ADE33CF98470FCD217AC92446E88D957CB36B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs-1.js
Size 6KB
SHA256 9d9bbd309107d92a0b861ef9b156c43a47034a8799ee8e435bda36b834616bd5
MD5 acd77c3c95c4ae272ac78fe1688af6ed
SHA1 96239dc07bbbbacef916b70777c1f0010b44042e
SHA512 809e2bdf0fb566270a3dbf49963d5da489a6d8e216fcf09df1547b7dbd9c9978e5f056d0d22cb6159a6bb5866aa30326193e75dc4af38798d7935c9f6c657602
SSDEEP 96:xHpUTUQqGqEfKil1zS6SSlSdv9j5nJH5VXBw88n8L4cnd2+q:7rREfKil/SSA51Bw88Uq
TLSH
T1F6E11F7895088B7F74B676ACAC648D316AB2023B7BBF28D750B554C4051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs.js
Size 6KB
SHA256 f28afd31ca2b4923b7c8e9ddbb034ea0af596d1840eaa3459a6dfdb74819f5d4
MD5 d310cf14cf8f9fc3e33e6bf14ee837d2
SHA1 ed9621de9b91b6ec6ff8cecbe7b4fd62c3734297
SHA512 4fb605ffc9ef062ecf6363a7b77fa8479d6dce966c529507d4c9b6565f97b983cbc4e2b6bd7beebf2d6a8d3d338623722e5680dd3284e403763663eae972dd88
SSDEEP 96:xHpUTUQqGqEfK+51zSuSSlSdv9j9DnJH5VXBw88n8L4cnd2+q:7rREfK+5/SSYx51Bw88Uq
TLSH
T12DE13F7895088B7F74B676ACAC648C315AB2063B7BBF68C750B59484051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs.js
Size 6KB
SHA256 ed6783e7286abfb9da8c68bcd0aac6cbb60b552143525f4cd4ffbc72cb29c3c9
MD5 d63c85df9285e988bcbc98d122b9fbe3
SHA1 0210d69a005a80ff6d14d0d5a5dc7def15d4d667
SHA512 e8399b4f97f163666036771d54c99b249bd01070b94ee1fde9a2586a53e7e7aaf7eb23b79130851dc1c7f4e057dd1b2c7692d6ba67b58818912b2b9ea7d4de89
SSDEEP 96:xHpUTUQqGqEfK+51zS6SSlSdv9j9DnJH5VXBw88n8L4cnd2+q:7rREfK+5/SSYx51Bw88Uq
TLSH
T10BE12E7895088B7F74B676ACAC648D315AB2053B7BBF28C750B594C4051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-26-0x0000000005E50000-0x00000000061A4000-memory.dmp

Download

memory/1720-29-0x0000000006450000-0x000000000646E000-memory.dmp

Download

memory/1720-52-0x00000000079B0000-0x00000000079C4000-memory.dmp

Download

memory/1720-15-0x0000000002B40000-0x0000000002B76000-memory.dmp

Download

memory/1720-14-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/1720-48-0x00000000079A0000-0x00000000079AE000-memory.dmp

Download

memory/1720-54-0x0000000007A90000-0x0000000007A98000-memory.dmp

Download

memory/1720-18-0x0000000005640000-0x0000000005C68000-memory.dmp

Download

memory/1720-19-0x0000000005570000-0x0000000005592000-memory.dmp

Download

memory/1720-47-0x0000000007970000-0x0000000007981000-memory.dmp

Download

memory/1720-46-0x00000000079F0000-0x0000000007A86000-memory.dmp

Download

memory/1720-45-0x00000000077E0000-0x00000000077EA000-memory.dmp

Download

memory/1720-44-0x0000000007770000-0x000000000778A000-memory.dmp

Download

memory/1720-43-0x0000000007DC0000-0x000000000843A000-memory.dmp

Download

memory/1720-42-0x0000000007460000-0x0000000007503000-memory.dmp

Download

memory/1720-33-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

Download

memory/1720-41-0x0000000006A00000-0x0000000006A1E000-memory.dmp

Download

memory/1720-32-0x0000000006A20000-0x0000000006A52000-memory.dmp

Download

memory/1720-53-0x0000000007AB0000-0x0000000007ACA000-memory.dmp

Download

memory/1720-30-0x00000000064E0000-0x000000000652C000-memory.dmp

Download

memory/1720-16-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/1720-20-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Download

memory/3004-1948-0x00000000074D0000-0x0000000007824000-memory.dmp

Download

memory/3004-282-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/3004-31-0x0000000006480000-0x0000000006532000-memory.dmp

Download

memory/3004-11-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/3004-49-0x0000000006700000-0x00000000068C2000-memory.dmp

Download

memory/3004-17-0x00000000063A0000-0x0000000006406000-memory.dmp

Download

memory/3004-55-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Download

memory/3004-13-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/3004-50-0x00000000065B0000-0x0000000006626000-memory.dmp

Download

memory/3004-51-0x0000000006630000-0x0000000006680000-memory.dmp

Download

memory/4136-4-0x0000000005760000-0x000000000576A000-memory.dmp

Download

memory/4136-5-0x0000000008A10000-0x0000000008A26000-memory.dmp

Download

memory/4136-10-0x00000000094A0000-0x000000000996C000-memory.dmp

Download

memory/4136-9-0x0000000008F70000-0x000000000949C000-memory.dmp

Download

memory/4136-8-0x0000000006FF0000-0x00000000070EA000-memory.dmp

Download

memory/4136-7-0x0000000006F50000-0x0000000006FEC000-memory.dmp

Download

memory/4136-1-0x0000000005D60000-0x0000000006304000-memory.dmp

Download

memory/4136-6-0x0000000005A10000-0x0000000005A20000-memory.dmp

Download

memory/4136-2-0x00000000057B0000-0x0000000005842000-memory.dmp

Download

memory/4136-3-0x0000000005A10000-0x0000000005A20000-memory.dmp

Download

memory/4136-0-0x0000000000C30000-0x0000000000D72000-memory.dmp

Download

memory/4300-1790-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/4440-205-0x0000012EB9F50000-0x0000012EBA092000-memory.dmp

Download

memory/4440-178-0x0000012EB9D10000-0x0000012EB9E52000-memory.dmp

Download

memory/5400-1660-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/5400-1781-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/6328-1834-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/6504-1617-0x000001CB0F790000-0x000001CB0F8D2000-memory.dmp

Download