Overview

overview

10

Static

static

10

2026-10-25...op.exe

windows10-2004-x64

10

2026-10-25...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 00:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_7116bbc2cca11dfb6b30863b4e947eed_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
  • Size 6.0MB
  • Sample261027-ak5tyaxt8l
  • SHA256 d849e634cae4531039294d9bb400f4b40209943f4bcf587081de6f23919846f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
  • UPX dump on OEP (original entry point) 8 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_7116bbc2cca11dfb6b30863b4e947eed_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7116bbc2cca11dfb6b30863b4e947eed_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:5852
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1540
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {a72a775c-7f26-446e-b74d-0d521da3ffcf} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
              PID:5604
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {72abbdb0-95ab-4421-b74e-d8ccf9106354} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              4⤵
                PID:6008
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3952 -prefsLen 25213 -prefMapHandle 3956 -prefMapSize 270279 -jsInitHandle 3960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {1a84bed5-f5ca-490c-8bc6-da51b03d31f7} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                4⤵
                • Checks processor information in registry
                PID:4348
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4108 -prefsLen 27323 -prefMapHandle 4112 -prefMapSize 270279 -ipcHandle 4180 -initialChannelId {36964360-ae00-4174-b9b4-b5793df65e3c} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                4⤵
                  PID:1080
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2748 -prefsLen 34822 -prefMapHandle 2884 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {9a33a72d-d957-491f-a416-e06bdb7cd0fc} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  4⤵
                  • Checks processor information in registry
                  PID:2636
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5164 -prefsLen 34929 -prefMapHandle 5168 -prefMapSize 270279 -ipcHandle 5180 -initialChannelId {dcf243c9-0261-409b-be93-94fc553cd59a} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  4⤵
                  • Checks processor information in registry
                  PID:3304
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1648 -prefsLen 35062 -prefMapHandle 2568 -prefMapSize 270279 -jsInitHandle 5372 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2912 -initialChannelId {90cc2b1e-c77a-4da2-9aa6-b2a1605e4e91} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  4⤵
                  • Checks processor information in registry
                  PID:4360
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4828 -initialChannelId {16a28262-9a98-4cce-9462-93f230c69e08} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  4⤵
                  • Checks processor information in registry
                  PID:3684
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 32952 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 5868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5876 -initialChannelId {412ca6d8-642c-4cb1-8b88-0c4b87d8e7dd} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  4⤵
                  • Checks processor information in registry
                  PID:1620
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6052 -prefsLen 32952 -prefMapHandle 6056 -prefMapSize 270279 -jsInitHandle 6060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6068 -initialChannelId {a5d04915-9926-42dd-907c-d47d2cf26995} -parentPid 1540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1540" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  4⤵
                  • Checks processor information in registry
                  PID:1048
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4932
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:6100
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:6016
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5560
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b11
              2⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:5480
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe55e0c188,0x7ffe55e0c194,0x7ffe55e0c1a0
                3⤵
                  PID:3816
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,18273273564875974142,16008509185508256450,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
                  3⤵
                  • System Time Discovery
                  PID:4608
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,14974558049873700556,4477397486758834880,262144 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
                  3⤵
                    PID:2976
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,11946712955140883002,14363255612876010860,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
                    3⤵
                      PID:964
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,5597621527903052049,12526934281845981617,2097152 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
                      3⤵
                        PID:4232
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,11682505336820697739,15458919896101040274,2097152 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                        3⤵
                          PID:1760
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,15679597778149675762,8737991599176895417,2097152 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
                          3⤵
                            PID:3448
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,13304951652806030578,17949988618833653706,2097152 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:9
                            3⤵
                              PID:5688
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,13905601372778943761,1940926665972490789,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
                              3⤵
                                PID:1832
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,11113570196211888916,11477085515604871329,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
                                3⤵
                                  PID:6364
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,5399927254916714157,15089977019038839011,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
                                  3⤵
                                    PID:6372
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17444721052434474853,5465499997693388711,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
                                    3⤵
                                      PID:6728
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,17444721052434474853,5465499997693388711,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
                                      3⤵
                                        PID:6748
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6497849206135465242,17590987675316530981,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
                                        3⤵
                                          PID:7152
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,1082456029636293591,16731141018631261456,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
                                          3⤵
                                            PID:7120
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,5260977604971352293,7534286932502505900,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
                                            3⤵
                                              PID:7072
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,3886147415120837297,14276812617325536925,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
                                              3⤵
                                                PID:7132
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,9162190619497528007,12524938258268098399,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
                                                3⤵
                                                  PID:6932
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,7786197775510201311,11848938339618921879,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
                                                  3⤵
                                                    PID:6684
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,16355265357978970645,18153380453497152094,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
                                                    3⤵
                                                      PID:6700
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,139230485055037788,2136317175870770622,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:14
                                                      3⤵
                                                        PID:6856
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,16548752178880720511,15524926953898958902,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
                                                        3⤵
                                                          PID:7116
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2848,i,12874386281700366660,3144617771208203032,524288 --field-trial-handle=2300,i,16403371124655250180,16719795751328138449,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
                                                          3⤵
                                                            PID:6344
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:3144
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                          1⤵
                                                            PID:6820
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                            1⤵
                                                              PID:1832

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Browser Extensions

                                                                  1
                                                                  T1176

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Defense Evasion

                                                                  Modify Registry

                                                                  3
                                                                  T1112

                                                                  Credential Access

                                                                  Credentials from Password Stores

                                                                  1
                                                                  T1555

                                                                  Credentials from Web Browsers

                                                                  1
                                                                  T1555.003

                                                                  Unsecured Credentials

                                                                  1
                                                                  T1552

                                                                  Credentials In Files

                                                                  1
                                                                  T1552.001

                                                                  Discovery

                                                                  Browser Information Discovery

                                                                  1
                                                                  T1217

                                                                  Peripheral Device Discovery

                                                                  1
                                                                  T1120

                                                                  Query Registry

                                                                  4
                                                                  T1012

                                                                  System Information Discovery

                                                                  5
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  System Time Discovery

                                                                  1
                                                                  T1124

                                                                  Lateral Movement

                                                                  Collection

                                                                  Data from Local System

                                                                  1
                                                                  T1005

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  symsrv.dll
                                                                  • Path C:\Program Files\Common Files\System\symsrv.dll
                                                                  • Size 67KB
                                                                  • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  symsrv.dll.000
                                                                  • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                                  • Size 114B
                                                                  • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  123c0d04-3585-448c-b2ca-2eb1cbc5ca9d.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\123c0d04-3585-448c-b2ca-2eb1cbc5ca9d.tmp
                                                                  • Size 42KB
                                                                  • SHA256 fbc9af524cbe8c535d47363a4d3f3789dd3d7fcfb4f8094be286210919a79034
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  45994fd7-0dd5-49f4-9e32-1ce289f6fade.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45994fd7-0dd5-49f4-9e32-1ce289f6fade.tmp
                                                                  • Size 37KB
                                                                  • SHA256 d7dac2c3b06091d0a7dbacf72a8d67473b6421f240845428fb7821113a7c9a17
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  472e12fa-f9e8-4cb2-9f55-d5ca61c065ea.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\472e12fa-f9e8-4cb2-9f55-d5ca61c065ea.tmp
                                                                  • Size 34KB
                                                                  • SHA256 b74641ed272328286b2934f9f409554825b31e6c214253f92a358d7f93ce0929
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  615abdc2-59e8-4992-b0c4-1882405928f9.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\615abdc2-59e8-4992-b0c4-1882405928f9.tmp
                                                                  • Size 38KB
                                                                  • SHA256 32209a00115295dbf5bedc6aa5a068ebd5981070457ba209d9453bb7bba19950
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  72c97570-1c37-48cd-a68f-483d2a415e34.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72c97570-1c37-48cd-a68f-483d2a415e34.tmp
                                                                  • Size 34KB
                                                                  • SHA256 8a1a0c6223f2576e8f697932811bbab2bcf8872e0613b0a9e23bde291579e188
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  35e6da48-1298-4a4d-90dd-d2d4cbc0e0c8.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35e6da48-1298-4a4d-90dd-d2d4cbc0e0c8.tmp
                                                                  • Size 12KB
                                                                  • SHA256 abc859cea74531c4d2bbeb4ad42a88c588c948128a4f5fccc2f3996768f39557
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  82534ca4-0b0f-4870-a4b0-168e0391c4a4.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82534ca4-0b0f-4870-a4b0-168e0391c4a4.tmp
                                                                  • Size 11KB
                                                                  • SHA256 13b249e2fda628f21aeee521832231cba0e8396344b914f73d98d2b871bd534d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  861170b0-d43a-47ca-b7b0-2d21857752dc.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\861170b0-d43a-47ca-b7b0-2d21857752dc.tmp
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 661c36a7b45ba414a85175fb3b06bb456ce95199295a36cbcaa4da5bc5c277b5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 ff761774ba368bafe4486cc5092554e75b567014cbb4fc52baaddafbd5acbc24
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  22f58920-8d36-4da0-aaf9-35df17262adc.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\22f58920-8d36-4da0-aaf9-35df17262adc.tmp
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  dasherSettingSchema.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                  • Size 854B
                                                                  • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  f139367c-98e6-40ca-8fbd-f28dfc600023.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f139367c-98e6-40ca-8fbd-f28dfc600023.tmp
                                                                  • Size 11KB
                                                                  • SHA256 6d8b6539084c530093822895ebb0c4f79f6b8de127ea7062f3bc62464f19a985
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  fa219a9a-7d7e-4beb-b2ed-453228dfd7f3.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa219a9a-7d7e-4beb-b2ed-453228dfd7f3.tmp
                                                                  • Size 29KB
                                                                  • SHA256 53b0fa37b7199092f6e6d290282593e30fb19a65b15d5f32394a6a31afff6a8d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  5e9a2424-6e96-4873-8a78-c1d7f20a4022.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5e9a2424-6e96-4873-8a78-c1d7f20a4022.tmp
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  14686491-c998-4290-a579-e02b82a13586.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\14686491-c998-4290-a579-e02b82a13586.tmp
                                                                  • Size 252B
                                                                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  e34b74d1-74f4-49b6-8748-23864b29586d.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e34b74d1-74f4-49b6-8748-23864b29586d.tmp
                                                                  • Size 132B
                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • Size 158KB
                                                                  • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ac1e1a3e-511e-4d00-a28e-014f68fa2518.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac1e1a3e-511e-4d00-a28e-014f68fa2518.tmp
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                  • Size 132B
                                                                  • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  f7b576a4-72cc-4e3e-a85b-b8914a0f84bd.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7b576a4-72cc-4e3e-a85b-b8914a0f84bd.tmp
                                                                  • Size 40KB
                                                                  • SHA256 5ab4fb0b6803f5075c120b4a13ac63b36b075475211cbf4efea755bbee838ff8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  activity-stream.contile.json
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.contile.json
                                                                  • Size 4KB
                                                                  • SHA256 013ac17ede8519b7ebc8806df8202aee750458fc7cf4416937fe29b063a21a0f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  activity-stream.discovery_stream.json
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
                                                                  • Size 75KB
                                                                  • SHA256 f44bf95bbc7fd017d80572b111f1ed207942fce7da18357756cf64930c3a0e6f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  E9338C5CCF1E2FCF149487351399F198A4F9FCD6
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
                                                                  • Size 16KB
                                                                  • SHA256 76eb01f2c95fb896e1fdc7cebdfd4547526a5444f1ea8c3769acca66e9f7d5b0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  webext.sc.lz4
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
                                                                  • Size 105KB
                                                                  • SHA256 32d7cb2e780335f5482946ea9e34d6d6b4c369fc80c1c80662f77e592973828a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  webext.sc.lz4
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
                                                                  • Size 106KB
                                                                  • SHA256 6958aad74743dcf2c60769cb826d041d21d7a9781b5c50e29bd93946850c590f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  57fae05e-bf4b-4156-9b64-2e9b58629418.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57fae05e-bf4b-4156-9b64-2e9b58629418.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  fc761f33-dfef-4088-94bd-9d9a45bb1fd7.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\fc761f33-dfef-4088-94bd-9d9a45bb1fd7.tmp
                                                                  • Size 10KB
                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  messages.json
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5480_1247355437\CRX_INSTALL\_locales\en_CA\messages.json
                                                                  • Size 711B
                                                                  • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  content.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5480_1828682312\CRX_INSTALL\content.js
                                                                  • Size 9KB
                                                                  • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 502KB
                                                                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 11KB
                                                                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 21.6MB
                                                                  • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  www_internetdownload
                                                                  • Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownload_1\www_internetdownload
                                                                  • Size 9KB
                                                                  • SHA256 5b462f6871410ba49ff47a42bc44d8451f93f60a1ece48381a912ac3519ef51d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  addonStartup.json.lz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
                                                                  • Size 4KB
                                                                  • SHA256 c3eb69bfc30f06eeab9d11f8cb812428c8d7b1f833c7fbda6b1b443c6118d912
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  broadcast-listeners.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\broadcast-listeners.json
                                                                  • Size 221B
                                                                  • SHA256 b883a7b2dcd1663cd2a903cd14eab810de12c5268a04593b30692eea61232c51
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  compatibility.ini
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\compatibility.ini
                                                                  • Size 198B
                                                                  • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  store.json.mozlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\crashes\store.json.mozlz4
                                                                  • Size 66B
                                                                  • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  data.safe.bin
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.bin
                                                                  • Size 39KB
                                                                  • SHA256 cb25df5557e7cb781fa62925048c2b66818c04f703c93ea17aa432720ee8127c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.bin
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.bin
                                                                  • Size 39KB
                                                                  • SHA256 c745ef482e59572c42326fc81e6e0677f58a6f637577dcedbec8771489831737
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 39KB
                                                                  • SHA256 d3ec4fc8551d64136680b91ff191de91b8a96aceb7e7eea9d173e488da714e65
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 29KB
                                                                  • SHA256 8efb4f162654293ddc0a83ef3f691c715c5ae77097c67e441c5666d8fda3aca1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 29KB
                                                                  • SHA256 898084414e59df4647b33c76e9209578834a46150e1b3bd34838559c389cab86
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 28KB
                                                                  • SHA256 dd9022e7da7e0af83397de475f97e15dcc669de813a9dfe8099aa31629b2bbfe
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  events
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
                                                                  • Size 1KB
                                                                  • SHA256 7c1abfb937ecd3ee199828aec538075859c80d4cc25bb3df5b772fb2fb49fa2a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  events
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
                                                                  • Size 2KB
                                                                  • SHA256 1644b22a77ef6f819d8842d9c3faa81438df2320350769a539aee4dc132211ab
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  1e950864-63a6-4c55-aa05-d600f934f17d
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\1e950864-63a6-4c55-aa05-d600f934f17d
                                                                  • Size 871B
                                                                  • SHA256 cf63ed36cb90b732fdf103e4af488be91e981256dc54212fdcb3b12492d91164
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  4ebc2766-c089-4e21-9655-aa28a20c0d30
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\4ebc2766-c089-4e21-9655-aa28a20c0d30
                                                                  • Size 235B
                                                                  • SHA256 ef1bd00d8eb5d3938645f9d218f400b62da143aed254ff57a37feddb1c79569e
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  7cea16ae-0833-40ab-90bb-e6335dbc366c
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\7cea16ae-0833-40ab-90bb-e6335dbc366c
                                                                  • Size 886B
                                                                  • SHA256 2f70f3b87c4b3ab24aef4d857a47168d336ea3eb6ca0779409ceecbe5efda653
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  9fb2a0df-7a03-41a6-a960-8fe2ab538de4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\9fb2a0df-7a03-41a6-a960-8fe2ab538de4
                                                                  • Size 235B
                                                                  • SHA256 50d5725fba537372f5cb7856970207ef0da45b610dec08dca2f52405b4dacd95
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  b8b775f5-ae33-42d6-b5ca-2f40940699e6
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\b8b775f5-ae33-42d6-b5ca-2f40940699e6
                                                                  • Size 2KB
                                                                  • SHA256 5b7951769f85b66a6fa9aa55556c01e8bd3155f575dfa0e4785ae47a71d83554
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  extension-preferences.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extension-preferences.json
                                                                  • Size 942B
                                                                  • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  extensions.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extensions.json
                                                                  • Size 14KB
                                                                  • SHA256 a2e21f6b1af114d61328e7decb2a1b15d63ce8587e88f19a3b4a1f892427f15e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  gmpopenh264.dll
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                  • Size 1.1MB
                                                                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  gmpopenh264.info
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                  • Size 116B
                                                                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LICENSE
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
                                                                  • Size 473B
                                                                  • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                  • Size 1002B
                                                                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  widevinecdm.dll
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                  • Size 21.6MB
                                                                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  widevinecdm.dll.sig
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
                                                                  • Size 1KB
                                                                  • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  prefs-1.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
                                                                  • Size 6KB
                                                                  • SHA256 a06c3f450df54fb0f8bb98b0d048d05d82363ed6caf4143e5c9a5cd10d82c56e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                                                                  • Size 6KB
                                                                  • SHA256 1495b348f43b9a0402cbb52be1a545cc854f95680a8ceec0151fd0b36dca9316
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                                                                  • Size 6KB
                                                                  • SHA256 3c64e5a3501cc3bc9f131179332952a087ce70d30b96e8f2465cb20667afb849
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                                                                  • Size 8KB
                                                                  • SHA256 de68177d959ceed290dad07753caab68e0f378ca36d3ab40ca7ee8adc49090d5
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sessionCheckpoints.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
                                                                  • Size 90B
                                                                  • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  sessionCheckpoints.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
                                                                  • Size 53B
                                                                  • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  recovery.jsonlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
                                                                  • Size 4KB
                                                                  • SHA256 47c22bdf0d75fa4aa9c75bb0530dfdf0ec4e3bd64854df3a4da29aa358a85215
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  recovery.jsonlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
                                                                  • Size 4KB
                                                                  • SHA256 ad44c71b5674457e57ac4c3e12d80de04e1d00e1784eabfc95ff690b0c6f85b6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 24ae298252bdd54a7cf93058e6809dc50eb34b745727afc58659482dead1cfbe
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 3cf4d2fd0f3505852555c72398d4b8a827afc2bbe2bc5ba8917b9ac1d674c6c2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 9048005fd3890eba330b5b7d2fde0ded210e0f3bd2614e8e85bbef9ce78f580c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 5.1MB
                                                                  • SHA256 15377f95eeac65639069f077f2d8d16c72072b963c537f277aa041ad3b839b45
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 6.2MB
                                                                  • SHA256 7d09de0e312c203ed1b9cb6404fa866f3c079964bb201c4f82e768f75ad258b0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 6.2MB
                                                                  • SHA256 076a324afca58b2a2662157152bf89e81d6f386ad91120747aed51423a4cc684
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 6.7MB
                                                                  • SHA256 d0b51d382c2dcffdfbbfac9c1adac3da4e333d2bd68f3a5ad5fc42f2773759f4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 bbbd7d30d164983c558f661fc5788b336e26fe43630ed11775273a2c8c151361
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 ec4e46408f6b9ec900fa645efaea4143782454c58aff05d30739a683bc16c477
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 97eb44107c0d9cc563f29000419855520b5aa635b299ef2f52c463164f801db7
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  targeting.snapshot.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\targeting.snapshot.json
                                                                  • Size 3KB
                                                                  • SHA256 85224070d126b8fde73243159f5431aeaeee44c0c52a4525dc96111b38db6db2
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5480_1079730473\manifest.json
                                                                  • Size 135B
                                                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5480_1541413493\manifest.json
                                                                  • Size 43B
                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  memory/1112-426-0x0000000000960000-0x0000000000F53000-memory.dmp
                                                                  Download

                                                                  memory/1112-401-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/1112-427-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/1112-467-0x0000000000960000-0x0000000000F53000-memory.dmp
                                                                  Download

                                                                  memory/1112-24-0x0000000000960000-0x0000000000F53000-memory.dmp
                                                                  Download

                                                                  memory/1112-1393-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/1112-1392-0x0000000000960000-0x0000000000F53000-memory.dmp
                                                                  Download

                                                                  memory/1112-25-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/1112-14-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/1112-1157-0x0000000000960000-0x0000000000F53000-memory.dmp
                                                                  Download

                                                                  memory/1112-9-0x0000000000961000-0x0000000000962000-memory.dmp
                                                                  Download

                                                                  memory/1112-1158-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/1112-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download