076ac14b0027e5013df471aabd85a6956976b43a0066beb6f732a0d9c6a0faba

Analysis

max time kernel
297s
max time network
459s
platform
windows10-2004_x64
resource
win10v2004-20230220-de
resource tags

arch:x64arch:x86image:win10v2004-20230220-delocale:de-deos:windows10-2004-x64systemwindows
submitted
13/06/2023, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Luna-Logged-roque (3).zip
Size

400KB
MD5

248fbd7b6f73beef836dd8b9f4013344
SHA1

2fd502c1882dab4443ddd96940f47a4e5eb43242
SHA256

076ac14b0027e5013df471aabd85a6956976b43a0066beb6f732a0d9c6a0faba
SHA512

357d38600976b64dccaf657e40d5ad67920754b3b491163199d3266d72c96e85a429e88a3ecb1b9d265d5ef8aa80de3daf3ff1ba0a3e073db602829c8936b6e0
SSDEEP

6144:JW2/vk/rQ1ur8pyC624r74+/7red9ZnaaE3lcnwFZlTMay7AMfEpEgzgtVbt2X:JrHkzQq9C6HjKaaEkilTRZEgf

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
972	api.ipify.org
973	api.ipify.org

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Monoxid Opener.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	firefox.exe
Token: SeDebugPrivilege	940	firefox.exe
Token: SeDebugPrivilege	940	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
940	firefox.exe
940	firefox.exe
940	firefox.exe
940	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
940	firefox.exe
940	firefox.exe
940	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
940	firefox.exe
940	firefox.exe
940	firefox.exe
940	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 1992 wrote to memory of 940	1992	firefox.exe	94
PID 940 wrote to memory of 1988	940	firefox.exe	95
PID 940 wrote to memory of 1988	940	firefox.exe	95
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4264	940	firefox.exe	96
PID 940 wrote to memory of 4120	940	firefox.exe	97
PID 940 wrote to memory of 4120	940	firefox.exe	97
PID 940 wrote to memory of 4120	940	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Luna-Logged-roque (3).zip"
1⤵
PID:3340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.0.328687662\1619557028" -parentBuildID 20221007134813 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {447d2dc6-e7c3-4e52-9353-efa07953612b} 940 "\\.\pipe\gecko-crash-server-pipe.940" 1916 2a32fc16858 gpu
    3⤵
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.1.1211692955\1971969031" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5435a811-56ec-48e9-9ae5-e3f650142d98} 940 "\\.\pipe\gecko-crash-server-pipe.940" 2316 2a321c72b58 socket
    3⤵
    PID:4264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.2.1777541653\1053953023" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2836 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5054cdfa-6c05-41ad-9b43-96be1ffd024d} 940 "\\.\pipe\gecko-crash-server-pipe.940" 3192 2a332945558 tab
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.3.1933687503\737168075" -childID 2 -isForBrowser -prefsHandle 3532 -prefMapHandle 1228 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb894b52-bef2-4242-b6ee-8e2d5d8c3295} 940 "\\.\pipe\gecko-crash-server-pipe.940" 3500 2a321c5e858 tab
    3⤵
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.4.1096388993\1966189764" -childID 3 -isForBrowser -prefsHandle 3860 -prefMapHandle 3856 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96e23c75-2002-4a78-bf56-49c0ac93309d} 940 "\\.\pipe\gecko-crash-server-pipe.940" 3868 2a333ac3e58 tab
    3⤵
    PID:3264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.7.457247796\822034759" -childID 6 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38bbafa7-83b5-457a-bbe0-bb3e1e7027b5} 940 "\\.\pipe\gecko-crash-server-pipe.940" 5436 2a3350f5358 tab
    3⤵
    PID:408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.6.2037267820\2002480820" -childID 5 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {797cc5b1-c581-4720-bc03-92ba711064ea} 940 "\\.\pipe\gecko-crash-server-pipe.940" 5252 2a3350f5058 tab
    3⤵
    PID:4784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.5.803008930\62671724" -childID 4 -isForBrowser -prefsHandle 5064 -prefMapHandle 5052 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6838f3f-0168-4d3f-a40e-d4c4f99ee85c} 940 "\\.\pipe\gecko-crash-server-pipe.940" 5088 2a3350f4a58 tab
    3⤵
    PID:2384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.8.971504664\61169764" -childID 7 -isForBrowser -prefsHandle 2660 -prefMapHandle 3704 -prefsLen 26770 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81da3c0d-b5f3-40ec-b0da-b07b10043f1e} 940 "\\.\pipe\gecko-crash-server-pipe.940" 2904 2a32ee9d358 tab
    3⤵
    PID:2272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.9.216842336\541612424" -childID 8 -isForBrowser -prefsHandle 9936 -prefMapHandle 9940 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7f5af59-b2d8-4ab5-b0d6-ccde7a7a91e2} 940 "\\.\pipe\gecko-crash-server-pipe.940" 9924 2a336ec9658 tab
    3⤵
    PID:4292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.11.718564421\1755412088" -childID 10 -isForBrowser -prefsHandle 9336 -prefMapHandle 9332 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd71b79a-9819-4a73-b9a6-ecc80a2ea6b3} 940 "\\.\pipe\gecko-crash-server-pipe.940" 9752 2a33796e258 tab
    3⤵
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.12.803659882\653387235" -childID 11 -isForBrowser -prefsHandle 9124 -prefMapHandle 9120 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36963869-7d3c-491b-97de-861d4970295d} 940 "\\.\pipe\gecko-crash-server-pipe.940" 9132 2a33796fd58 tab
    3⤵
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.10.623013430\1977707308" -childID 9 -isForBrowser -prefsHandle 3496 -prefMapHandle 9492 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf3b561e-adeb-4433-a0ad-56d9928f4031} 940 "\\.\pipe\gecko-crash-server-pipe.940" 9684 2a33733a258 tab
    3⤵
    PID:1036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.15.752477036\1875363753" -childID 14 -isForBrowser -prefsHandle 8564 -prefMapHandle 8560 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd0c5692-fda5-4bfa-b0fa-ba3eae117898} 940 "\\.\pipe\gecko-crash-server-pipe.940" 8576 2a3386a3b58 tab
    3⤵
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.14.1708253321\916537726" -childID 13 -isForBrowser -prefsHandle 8756 -prefMapHandle 8752 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87b51740-cec8-481e-b381-3d6e915933f7} 940 "\\.\pipe\gecko-crash-server-pipe.940" 8764 2a338758758 tab
    3⤵
    PID:5192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.13.799540453\1015023058" -childID 12 -isForBrowser -prefsHandle 5012 -prefMapHandle 8844 -prefsLen 27035 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77eaf859-d313-4567-a6fb-a560245f158a} 940 "\\.\pipe\gecko-crash-server-pipe.940" 8848 2a338759f58 tab
    3⤵
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.16.577893612\1529480900" -childID 15 -isForBrowser -prefsHandle 7784 -prefMapHandle 7812 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58eaf4c4-a2e0-43be-98de-c6d14aa9cc10} 940 "\\.\pipe\gecko-crash-server-pipe.940" 7788 2a339a80458 tab
    3⤵
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.19.1793845186\1269114483" -childID 18 -isForBrowser -prefsHandle 8520 -prefMapHandle 8144 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b634da7-d2f7-44c1-8c2a-958fb33d9702} 940 "\\.\pipe\gecko-crash-server-pipe.940" 8484 2a339dfd958 tab
    3⤵
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.18.449726861\951476059" -childID 17 -isForBrowser -prefsHandle 7532 -prefMapHandle 7536 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88f3845c-6537-4969-b219-8a3998e7e0a4} 940 "\\.\pipe\gecko-crash-server-pipe.940" 8144 2a339dfd358 tab
    3⤵
    PID:5460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.17.426880091\489718493" -childID 16 -isForBrowser -prefsHandle 7544 -prefMapHandle 7548 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d45888-66c0-4c90-b206-fced9ee139ac} 940 "\\.\pipe\gecko-crash-server-pipe.940" 4788 2a339dfc458 tab
    3⤵
    PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.20.1063645889\1614383915" -childID 19 -isForBrowser -prefsHandle 7072 -prefMapHandle 7024 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff41b5ec-11a9-49c8-93d9-3bee4b093c91} 940 "\\.\pipe\gecko-crash-server-pipe.940" 7096 2a339f41558 tab
    3⤵
    PID:5852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.21.676212763\1203738431" -childID 20 -isForBrowser -prefsHandle 6812 -prefMapHandle 6808 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac67aae0-6096-4358-8aaf-724113d77753} 940 "\\.\pipe\gecko-crash-server-pipe.940" 6820 2a33a6bd758 tab
    3⤵
    PID:5948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.24.614879596\752653548" -childID 23 -isForBrowser -prefsHandle 6304 -prefMapHandle 6300 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30590fe9-2035-4dc8-96a4-882fe7803ea9} 940 "\\.\pipe\gecko-crash-server-pipe.940" 6520 2a33ae09658 tab
    3⤵
    PID:1716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.23.2079023316\1126658246" -childID 22 -isForBrowser -prefsHandle 6500 -prefMapHandle 6496 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdb8e336-0179-4dfb-af06-7ca7fa861066} 940 "\\.\pipe\gecko-crash-server-pipe.940" 6588 2a33ae0ae58 tab
    3⤵
    PID:4392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.22.888681596\2055737734" -childID 21 -isForBrowser -prefsHandle 3012 -prefMapHandle 2912 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d5758bf-4065-4056-a8be-d3cdd528d722} 940 "\\.\pipe\gecko-crash-server-pipe.940" 6576 2a33ae08a58 tab
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.25.166368310\1348139932" -childID 24 -isForBrowser -prefsHandle 9764 -prefMapHandle 2688 -prefsLen 27075 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bb19a2c-87fb-4b82-9788-87625f1ebf7c} 940 "\\.\pipe\gecko-crash-server-pipe.940" 7020 2a321c2f658 tab
    3⤵
    PID:6700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.26.1313730121\405954486" -childID 25 -isForBrowser -prefsHandle 7648 -prefMapHandle 9036 -prefsLen 27211 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e508ea12-6c0f-4c73-98a2-419419c4eeb2} 940 "\\.\pipe\gecko-crash-server-pipe.940" 6260 2a3386a3858 tab
    3⤵
    PID:6172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.27.1007115111\942842483" -childID 26 -isForBrowser -prefsHandle 9600 -prefMapHandle 9504 -prefsLen 27211 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31c153d7-176c-4abe-a9ba-e9bc4118013c} 940 "\\.\pipe\gecko-crash-server-pipe.940" 10128 2a336ec8158 tab
    3⤵
    PID:6216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.30.2070607302\977317107" -childID 29 -isForBrowser -prefsHandle 10612 -prefMapHandle 10616 -prefsLen 27211 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {092ec740-a6ae-4cc9-9b6d-b4241c954e49} 940 "\\.\pipe\gecko-crash-server-pipe.940" 10700 2a337340658 tab
    3⤵
    PID:6512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.29.1510904903\468266978" -childID 28 -isForBrowser -prefsHandle 10436 -prefMapHandle 10440 -prefsLen 27211 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {675bbbee-489a-44de-b741-bb1ab40dd7a8} 940 "\\.\pipe\gecko-crash-server-pipe.940" 10428 2a32ee9eb58 tab
    3⤵
    PID:6524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.28.695573947\2011098309" -childID 27 -isForBrowser -prefsHandle 10368 -prefMapHandle 10088 -prefsLen 27211 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27fa0fcb-fd74-4bdc-8443-b01a6bd5eddc} 940 "\\.\pipe\gecko-crash-server-pipe.940" 10360 2a32ee9b558 tab
    3⤵
    PID:6508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="940.39.1139515536\851044596" -childID 35 -isForBrowser -prefsHandle 3592 -prefMapHandle 10728 -prefsLen 27290 -prefMapSize 232675 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d4e214f-e3c2-45bb-8e8b-a1826a56ab49} 940 "\\.\pipe\gecko-crash-server-pipe.940" 6476 2a321c5cd58 tab
    3⤵
    PID:9112

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Monoxid Opener\Monoxid Opener\run.bat" "
1⤵
PID:6320
- C:\Users\Admin\Downloads\Monoxid Opener\Monoxid Opener\dll\3.exe
  3.exe
  2⤵
  PID:6656
- - C:\Users\Admin\AppData\Local\Temp\堝霾妇碖覹艛疳菞梣秄狕滍錫嗪麟侰.exe
    "C:\Users\Admin\AppData\Local\Temp\堝霾妇碖覹艛疳菞梣秄狕滍錫嗪麟侰.exe"
    3⤵
    PID:6784
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\bn.txt
      4⤵
      PID:6920
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\fr.txt
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\fur.txt
      4⤵
      PID:6724
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\ka.txt
      4⤵
      PID:6484
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\si.txt
      4⤵
      PID:6964
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\zh-cn.txt
      4⤵
      PID:6984
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe"
      4⤵
      PID:7944
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff712b97688,0x7ff712b97698,0x7ff712b976a8
        5⤵
        
        PID:7964
  - - C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe
      "C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe"
      4⤵
      PID:7260
  - - C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe
      "C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe"
      4⤵
      PID:7372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html
      4⤵
      PID:7296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb59d846f8,0x7ffb59d84708,0x7ffb59d84718
        5⤵
        
        PID:8116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        
        PID:8164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
        5⤵
        
        PID:7656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        5⤵
        
        PID:7220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:8464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
        5⤵
        
        PID:8456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
        5⤵
        
        PID:8792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
        5⤵
        
        PID:8596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
        5⤵
        
        PID:8292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        
        PID:644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        
        PID:8992
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7cf915460,0x7ff7cf915470,0x7ff7cf915480
        6⤵
        
        PID:7204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        
        PID:7592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12544693549313340161,7866105474657999473,131072 --disable-gpu-compositing --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1360 /prefetch:1
        5⤵
        
        PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html
      4⤵
      PID:7424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd4,0xfc,0x100,0xf8,0x104,0x7ffb59d846f8,0x7ffb59d84708,0x7ffb59d84718
        5⤵
        
        PID:7524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,5686904679521840470,17643018726146613029,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        5⤵
        
        PID:7916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5686904679521840470,17643018726146613029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        5⤵
        
        PID:7868
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt
      4⤵
      PID:8568
  - - C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE
      "C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE"
      4⤵
      PID:8928
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js"
      4⤵
      PID:3016
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.INF
      4⤵
      PID:8556
  - - C:\Program Files\Mozilla Firefox\uninstall\helper.exe
      "C:\Program Files\Mozilla Firefox\uninstall\helper.exe"
      4⤵
      PID:4504
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\SelectDisconnect.css
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html
      4⤵
      PID:7868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb59d846f8,0x7ffb59d84708,0x7ffb59d84718
        5⤵
        
        PID:7560
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js"
      4⤵
      PID:4220
  - - C:\Program Files\VideoLAN\VLC\uninstall.exe
      "C:\Program Files\VideoLAN\VLC\uninstall.exe"
      4⤵
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
        
        "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\VideoLAN\VLC\
        5⤵
        
        PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.videolan.org/
      4⤵
      PID:7716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb59d846f8,0x7ffb59d84708,0x7ffb59d84718
        5⤵
        
        PID:8616
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\ormma.js"
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html
      4⤵
      PID:9020
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\main.js"
      4⤵
      PID:6936
  - - C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe
      "C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe"
      4⤵
      PID:7740
  - - C:\Windows\SysWOW64\PresentationHost.exe
      "C:\Windows\System32\PresentationHost.exe" "C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\xaml\onenote\CaptureUIStyles.xaml"
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\PresentationHost.exe
      "C:\Windows\System32\PresentationHost.exe" "C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\DefaultResourceDictionary.xaml"
      4⤵
      PID:632
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\startup.js"
      4⤵
      PID:7528
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\js\url-polyfill.min.js"
      4⤵
      PID:3152
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\webviewCore.min.js"
      4⤵
      PID:1108
- C:\Users\Admin\Downloads\Monoxid Opener\Monoxid Opener\dll\1.exe
  1.exe
  2⤵
  PID:2816
- - C:\Users\Admin\Downloads\Monoxid Opener\Monoxid Opener\dll\1.exe
    1.exe
    3⤵
    PID:6688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
      4⤵
      PID:7396
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        5⤵
        
        PID:7524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x37c 0x2e8
1⤵
PID:6692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7204

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7812

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7752

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8008

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8992

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7352

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:632

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8472

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb59d846f8,0x7ffb59d84708,0x7ffb59d84718
1⤵
PID:5012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7080

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:9064

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2172

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1b1f3b846afccf52ab4e0d365b8a74bd

SHA1
f09584fbb57b4bc9a57f474db9a84ec66d8a0ccc

SHA256
9ac0b978463b4c612ae58d976fd2bf2b350e157c86895de5d193703fa68369dd

SHA512
69472009486fa77b036d84fcafcf125dae53c64cb9ff222ad21362731afd295d972b890547e487da13e397fb7fa2fc767a5d2b50b708708b625b1863c40aeede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2ee6ec5f8dc39b37a17d4b3c3d2cc0f2

SHA1
1645dc1c84927f2bfd795709b0f0f8898c8619ee

SHA256
613cda7c54874adb8723525666b00ad927029619b5f95a6c4a6f31c2a103af6e

SHA512
6b1787ed277916a978011d5064a799eedf33e265487d179043fd3c3e18018a5efc67ab902048b7274f1c80309eaa10519f0b64cda6cb4b9f174c8bafc26b3613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c8331.TMP

Filesize
48B

MD5
38ea75c3ec692b60271c003303b7e7c2

SHA1
77c6b118f2bad1d7b16dbbfe059eabfe7d9262c9

SHA256
c7da6e60a6e5676f9c7b65e494a3caa0784b0830220910913d0bcd6ff0b2b0f3

SHA512
72244204971cbc978c8554d3064cda89c06d50b83980e2d1e1b69f1f151ffed0e0c4c1ccb6dfe83c37b920ba7b94ecf5b5a478e97f20ef373a8fc6d4bea2a2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
91e335f02b159b0ee52b17152215c825

SHA1
943a848fca67ad7453591fba91b6508addbe236c

SHA256
91eb76d660bb0dfa3aae1b449d701c3c591edcebae910cf824f1f1f9701d8f33

SHA512
9297952b7be9be2069de714459b994f2f932b2705741a77ac1954237595bede159ebd0d6059fff8ab8fbbc91269c87351089b455f0074f74e4d9e9c2fb3e6ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
555B

MD5
a001b89abcb9ca47d871236743ed4998

SHA1
6ef47f1aa3235bc9d30f53d934a33e6a42db4363

SHA256
417b2206597d2d937e830f03350738483b428f6eb4f118f3fc64281c9a1cad56

SHA512
79836356d76743c00ba479e6cf38e9836b14a428db42edae6065ad33ae7a40afffa0dfd6e8a8d3398092b4dfbc8aa10668ae1c99915f160051b1e45577d151dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
80875d61b274cf01bf930d32e33d523c

SHA1
11b20174143c4ec5b4ee13ef2f3a1500e70593d2

SHA256
52c0f261e061a9a96022510843aea3c84ead1e8e9de8f937dd75d6e4db104d1d

SHA512
65354e26501aeca34aed5e7683fe1bfcd1bdd4167ce488f92744bf7eec46b1e838a0199f945986ffde67a4b991a5f4b66045ac51ca6e23b6de20ef2093bf9932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac2243d319c27a751bef9bce7674a68a

SHA1
24b2268573e7a927c57e7f98fd0b66078543d18f

SHA256
d4c6430f287dfaaa65ad4ba40db29933edbedaca0ba12a99ae910f362306b606

SHA512
19b42a0ea65fc57a9dc7936722d7749da39982e0f790f58813a7d225a07aa397d2b96d05f78f28f4417091266f7fef526a84172195abbae10821fd6aa2d34e7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
df5dbb95ff4d6fb321fbf5bb7ab9de03

SHA1
7e78819148678ec96b3b72a0af502d768363792b

SHA256
ec6c6529b3c865ac67bffd228658503b18b24f58b491b28c238a469191b008c1

SHA512
7c2003f785f8b08830165838b51400b01c8a166cc1d72fdf417b2db4fb1bee9534ba597baa38d49a9f692a28943b8fed3caf8d95f272a62ea9badc1cdd1e4320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1e72f697075c9b16df75d7f84bb1d2d

SHA1
375693152f8dd1619b4c457bb048fb6e82cbb720

SHA256
f5051746f3b74e281a7b5f285a1b30101d583c14852b6e2f76f5e58dd7cd8075

SHA512
ee72d6c83d886ee3321e667825f2a720df11f98117c73e8980fee5db7a874587197f9614116b96bdd720553fef5461c456cc71f1b614b99dada6353248047438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
858917c8c7749dd9f7be514cf6548842

SHA1
80092edfd5c1629883d6208bafb6c9d11e021c00

SHA256
4f0d07da64489c8ce35b79a7e70a789c78677fefb2fd27e72d91ef603bcbfe54

SHA512
164042452f3d460ae2145f9cf4fc5273d70e57758ed8446cef940a905caa445f05e4023c6cdd76a967e8cbcf2d7df242af06257510541793c004f40355a8ad9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
bc5f988722f72244e9a4aa8e1d6a0ee2

SHA1
4a132601b1d75fe013d364df95b711223eb9f742

SHA256
8ae99505d61450350ed2799d1bcca3cf9bcd4dd2e6a99cfcfcb2e929704592d9

SHA512
be7c42520bfe8aa8a966881190240bfef15471e84c4dad78ee3c3c0adc14d02e24f6eb950a68914d5870d51c4e91e42cb91eaedc69c360cb9cdc70c40d0cea2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
90a87b7fb36f01dd2202389975c0207d

SHA1
093410d29c3957033d08353e3425ab0d9cb8ec2b

SHA256
d04f5b4c6b13f27f155d0873b1b8792368f46275430d7443df7db5a87fc1a8fe

SHA512
a5d61c2207a69166c7d353f0af47601004f5ca7b25ed7dc5a57bc16f2b26016122d2897ce2c9bb0ee6acf512475d365671bd2b17a33a05918066fc59995a730b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
015005985fd3beca27386eec7582cc2b

SHA1
6f3c6d93ad3301ca6c1a76891ce2486bcdf093a4

SHA256
aec37859da65db6ce42c2b0ff3d142413a6f23d50bef193383cbcbc645ccd5b7

SHA512
f8736f62c33c4e0a119028ac4d71459a99baf017865ea45d7320986c3bb702277fde7e09f6608cefa13616d456b88d9c0bddcde0fedf4357e156fbf7480428fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
028c304ceca7695fc85b2d7563d32109

SHA1
b448f580e47ddf8ef5e6c564dadca8334e191862

SHA256
a0858fedfbe9ce9de9b2d09b343460d78046771d45a7455d87b1923bf2a16f86

SHA512
c41f08aa2f6c1c46c590ef66b1b2cd34a5726d00c1acc93da7438e367251f38eebab36c68aa3892f6533c2ad1624790ce92dfbbac372fd6e024f7935e9aaf0bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5cac93.TMP

Filesize
539B

MD5
e0d708c3b167692f49479f11dbf69c26

SHA1
4ca9f72a07b88dc97456dcf7cc6952a97c638ee2

SHA256
aafd0548410d060a6e72813eb0d52cf8a231a281bef1e069155ab1ecacbb759d

SHA512
03396b3fec20163deb7df8640b3ee943bc1d00bbe2130110acef128519fd1eea8f5209432829af694a638da566356aee802f85eee5e0999ac6cc2e645697b769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
040a4e095843ad98b5eeb719d94ebf03

SHA1
d1f74c7febc68bca81a91a654540f1887b8185a6

SHA256
e83af882348f4fae29d1b00d721cd3b1e8a1b29117675aeb892c513e8eaf0e96

SHA512
bc9e385ccd27467935dfd7dcb7900a5b944404111ca626c08ee60c5f280a1ca3acc9ec81f71026d7622fec0c44b96c20dee03a854ac75697a28d46ec6b153442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
6ee543398cd255bd403f9fb83ede8c2a

SHA1
26a7e0da10ffd636fbb48e1eceff9503d890da94

SHA256
db5616bead0da4c4c341f19bd3c2959ad0df90cdfe2eeaab71eac8201ab067a1

SHA512
ad835e8c5060d5effd29143b1836c987e1178b54a12f6e4c5bd0ac84bc49f5a55175138fed5edf3da419b71264881de7bdf7e4fdc174652b9c87413085864bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f348192c-2208-41c2-868b-1240f2c697f4.tmp

Filesize
9KB

MD5
924c8c45ca804fb71879981555c44fef

SHA1
8d624acd3a1d771246006ba606aa9148dad12c8a

SHA256
ca5853b2a3534bc745cf1a2eb34fe7d81462b83293911bc25d6448168e1c3c16

SHA512
a954762cb9fc8f286c945f47c48f5329ceeff6b11b9efe008208feb35bdda01e221159be861c6280d375b5bbe067efb1271786d84e0e2f5314b40801b261dd7f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\activity-stream.discovery_stream.json.tmp

Filesize
149KB

MD5
62e5d326575c349c10982781884e4c9e

SHA1
970442c81e92c2c02cd3c5ca1865288da55cd7a0

SHA256
30bea20c05bff8d1843374b85fe22bb189337e42a0e0b098df710164dd86af01

SHA512
45df2609b7d54727a134d83b0607a4c05b37c025293736cf625d39f01d64c2eea8e3e9e169ce21bc9f659fc1a48389abe9b82060842a304bc46993630222562b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\14370

Filesize
10KB

MD5
bfe4e1c6d8cac72ef62f0a2be817b530

SHA1
b5c6b21504555eef36939bc595a2abecb136f600

SHA256
af5d6fe4a1df5631887277fac91e7f3e2217331822ad751008889ac491862c10

SHA512
3836fd3f6a5439c468668a6ffc0e51b914ddea7d478d9c2e4e1943cca87d460697be5e0656f994392b6fb4a9ccb2fbc518cab718a14efd2cdb41e2b2646eff72

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\18064

Filesize
10KB

MD5
28822bbe6999b2cf2973bdf1aaff18e4

SHA1
a729011739dad224d09877f43958f3a7094ebd5a

SHA256
ebff57b056d997bb7858451b9ffaf2a1485156ebb6dd0fe191519fa4e908cc79

SHA512
394911c2de10e2aafc64d39a765708304374a776cdfd3617ae88fa78c4d8f1605f2f2ea273bce7e8bf0be7b810f6ba967dc6a509babee64770fa6c4041973d7b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\23043

Filesize
10KB

MD5
2cba91eaad460c1e4c3c4fc95d07d13a

SHA1
d4d455c426562feb9df44a6a77dd4a5079aceebf

SHA256
65079150bb6d38b333cc169e6181198abab725598053482f18c0433dd8e546f5

SHA512
d566e41122d1c959d76ef6e89b4f6b03298487af4623a4c2f3472b93d5aa598b42caddd6fce93a75906c105dc8630b539aff1cf3b9f1ed8f3abb6dc163d670a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\25550

Filesize
10KB

MD5
3a169d7157c474b3dba2e540c1e0be54

SHA1
6316bf78b461735ec3029dcd9ed1d9bd728a7b44

SHA256
e9a36734c8d72ddd4b8704bed9ed4838f547bacec3a722f8179a5faae322a562

SHA512
12624e6ba7b23041c7227f4af97c4f17a298e512d825f1d799169113e6129324a34728ed62fbbfd6dfb7e11756369ec60ef4395f4aa6cdcb54c1d0a249ed53f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\26924

Filesize
10KB

MD5
d1406bafdf6b936b5d191544dd9af4cf

SHA1
4143fc84f694a5cda741eb98792d7d5bc0751f14

SHA256
3bb26b6764421be41e8a0a1e80f875a366e29199c21a3ac9885b7a26225e63f7

SHA512
1c79fb0d1d8514c6ad72ea47a563826386c0c2aadeb4cf5ecd959c34a346d3d2a96dd9cc9621264994eca4b1cb8a2717e052aee7b66248528ca08fba7c9a7a5f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\32615

Filesize
10KB

MD5
ada3093cff62394a775feca0973108f5

SHA1
5371f868ea4bd9d2eb50e9c81f846c00fa61969a

SHA256
3e095461cfc7737937aaf28e521b51f51d04878019b550663377bd4167b135d6

SHA512
7db2d2985e9388a5c2eb04d3e7e3be7a318c77a2e1949257b6505692356b22d895ee0038b9b05d98f0ed63df6105299eb1db270053bae4647ae64132afafb8e7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\7839

Filesize
10KB

MD5
f87e078ae4226f82055e09f8c9d4994f

SHA1
da2b7ece64fcd1a3fbb05045d686077de472902a

SHA256
27fa59f8bb0106deeeca1e903202230a636479f6bec283c19a287b063e6f494c

SHA512
0e1f14cac6103effab23959229b6285f8ae8148ed6034ac6d023e16bdccdc4e74f270bcd18ad80f6b8fb1adc6a44cddde059b9abcab504747d4d7dcba5d6c9ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\doomed\9574

Filesize
61KB

MD5
05c03ffbfed84f0e7e9babbe82207d3b

SHA1
12d6ae1d6ad7dfd88e6ac3d0f6905b9ef772319f

SHA256
6508a246fea575b4963de81d5b2a485aef8244330c57a7da80e3cbf8ba01d698

SHA512
3c686619abbad588d5f826e5a5f95dfb83673c0d9d22d5ad51b69ab5cd38d743bab24d897e44220049967743a0bde7071ab700c6350d4b34c97131db2044a23b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\3C4AE5AEE279BCBB3D1D97B0F2B64778701329F5

Filesize
46KB

MD5
58be6e7b06030b5c3626ed88d7c56858

SHA1
bf43b175f8f58baf2fe68c54afc73ebf146bf9bc

SHA256
521e1a7a7b9031d6da96239518fcc1c33315e8bd163029ea55a0bf3ae6ea1a10

SHA512
5f9d101bf014bf22c98ca3cf5d32e629dd96f61ceb9d240f3ca16819a6eb0dabba1c1a0e75622880165003f0d3253411f1da919193067df34b5415de82a16623

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\85BC3DC270F6F06AB0F714F9ABCF960FF3576C7A

Filesize
101KB

MD5
420ae92f553c2e8f0d789c8a3d581577

SHA1
a741b46314b0d27b05fc5e8582684330f2d5ae5e

SHA256
114745f0f7343a77186a3c2742c271a54d44d9a820bfe8100ca69076f89e04e7

SHA512
6ff171d77e8d9c30cfd54ffee97ad6828e78280a48e1beba839794b1f52464a7dc88e05f366db70c324cda52e27a6c81974060a7b33ef989b68c79ec2a8667ae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\cache2\entries\95D45568ABBA53C41374A36FCB8ED9369DAA33CA

Filesize
14KB

MD5
82736216b3f6d60aa0108cd651a4a39b

SHA1
587b1cb0b5cc156199bea59bfec446fa8b3faf2f

SHA256
aa4152fb15b9c45f6d109d9980e61607de1f4960c743a7c5abfc7405ad1e470d

SHA512
9c208d6569d2416ac77ac051e1e81b55607d63a21fc815fb20022830476cec28726e269991018cbaa1e911ebccfe973aee893547726844bdd3dcbd81d789cad4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\safebrowsing-updating\ads-track-digest256-1.vlpset

Filesize
54KB

MD5
4f9ef3d3a71d4cb49e623e3f4b7b1162

SHA1
c2d65973b44b051d043475e9387fa7100514acbd

SHA256
48ae004f3c542ac764dd5a1e894918ec4b250b5c1f7209256c191cae13106b1f

SHA512
f7017204ad37ceedbff4e8b58ab4edac75748d2f36693e59ea9d9157f637d29b53c6405d994ac9fc62712f2574013e95c4817ff49229c78dcc23cac805b13ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\Crypto\Cipher\_raw_ecb.pyd

Filesize
10KB

MD5
821aaa9a74b4ccb1f75bd38b13b76566

SHA1
907c8ee16f3a0c6e44df120460a7c675eb36f1dd

SHA256
614b4f9a02d0191c3994205ac2c58571c0af9b71853be47fcf3cb3f9bc1d7f54

SHA512
9d2ef8f1a2d3a7374ff0cdb38d4a93b06d1db4219bae06d57a075ee3dff5f7d6f890084dd51a972ac7572008f73fde7f5152ce5844d1a19569e5a9a439c4532b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\VCRUNTIME140_1.dll

Filesize
48KB

MD5
7e668ab8a78bd0118b94978d154c85bc

SHA1
dbac42a02a8d50639805174afd21d45f3c56e3a0

SHA256
e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

SHA512
72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\VCRUNTIME140_1.dll

Filesize
48KB

MD5
7e668ab8a78bd0118b94978d154c85bc

SHA1
dbac42a02a8d50639805174afd21d45f3c56e3a0

SHA256
e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

SHA512
72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_asyncio.pyd

Filesize
63KB

MD5
61a5ae75f514b3ccbf1b939e06a5d451

SHA1
8154795e0f14415fb5802da65aafa91d7cbc57ec

SHA256
2b772076c2dba91fb4f61182b929485cc6c660baab4bce6e08aa18e414c69641

SHA512
bcd077d5d23fdab8427cc077b26626644b1b4b793c7f445e4f85094bd596c28319a854623b6e385f8e479b52726a9b843c4376bf288dc4f09edc30f332dbaf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_asyncio.pyd

Filesize
63KB

MD5
61a5ae75f514b3ccbf1b939e06a5d451

SHA1
8154795e0f14415fb5802da65aafa91d7cbc57ec

SHA256
2b772076c2dba91fb4f61182b929485cc6c660baab4bce6e08aa18e414c69641

SHA512
bcd077d5d23fdab8427cc077b26626644b1b4b793c7f445e4f85094bd596c28319a854623b6e385f8e479b52726a9b843c4376bf288dc4f09edc30f332dbaf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_bz2.pyd

Filesize
82KB

MD5
a62207fc33140de460444e191ae19b74

SHA1
9327d3d4f9d56f1846781bcb0a05719dea462d74

SHA256
ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2

SHA512
90f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_bz2.pyd

Filesize
82KB

MD5
a62207fc33140de460444e191ae19b74

SHA1
9327d3d4f9d56f1846781bcb0a05719dea462d74

SHA256
ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2

SHA512
90f9db9ee225958cb3e872b79f2c70cb1fd2248ebaa8f3282afff9250285852156bf668f5cfec49a4591b416ce7ebaaac62d2d887152f5356512f2347e3762b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_cffi_backend.cp311-win_amd64.pyd

Filesize
177KB

MD5
fde9a1d6590026a13e81712cd2f23522

SHA1
ca99a48caea0dbaccf4485afd959581f014277ed

SHA256
16eccc4baf6cf4ab72acd53c72a1f2b04d952e07e385e9050a933e78074a7d5b

SHA512
a522661f5c3eeea89a39df8bbb4d23e6428c337aac1d231d32b39005ea8810fce26af18454586e0e94e51ea4ac0e034c88652c1c09b1ed588aeac461766981f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_cffi_backend.cp311-win_amd64.pyd

Filesize
177KB

MD5
fde9a1d6590026a13e81712cd2f23522

SHA1
ca99a48caea0dbaccf4485afd959581f014277ed

SHA256
16eccc4baf6cf4ab72acd53c72a1f2b04d952e07e385e9050a933e78074a7d5b

SHA512
a522661f5c3eeea89a39df8bbb4d23e6428c337aac1d231d32b39005ea8810fce26af18454586e0e94e51ea4ac0e034c88652c1c09b1ed588aeac461766981f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_ctypes.pyd

Filesize
120KB

MD5
9b344f8d7ce5b57e397a475847cc5f66

SHA1
aff1ccc2608da022ecc8d0aba65d304fe74cdf71

SHA256
b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf

SHA512
2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_ctypes.pyd

Filesize
120KB

MD5
9b344f8d7ce5b57e397a475847cc5f66

SHA1
aff1ccc2608da022ecc8d0aba65d304fe74cdf71

SHA256
b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf

SHA512
2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_hashlib.pyd

Filesize
63KB

MD5
787b82d4466f393366657b8f1bc5f1a9

SHA1
658639cddda55ac3bfc452db4ec9cf88851e606b

SHA256
241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37

SHA512
afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_hashlib.pyd

Filesize
63KB

MD5
787b82d4466f393366657b8f1bc5f1a9

SHA1
658639cddda55ac3bfc452db4ec9cf88851e606b

SHA256
241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37

SHA512
afcf66962958f38eec8b591aa30d380eb0e1b41028836058ff91b4d1472658de9fba3262f5c27ba688bd73da018e938f398e45911cd37584f623073067f575b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_lzma.pyd

Filesize
155KB

MD5
0c7ea68ca88c07ae6b0a725497067891

SHA1
c2b61a3e230b30416bc283d1f3ea25678670eb74

SHA256
f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11

SHA512
fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_lzma.pyd

Filesize
155KB

MD5
0c7ea68ca88c07ae6b0a725497067891

SHA1
c2b61a3e230b30416bc283d1f3ea25678670eb74

SHA256
f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11

SHA512
fd52f20496a12e6b20279646663d880b1354cffea10793506fe4560ed7da53e4efba900ae65c9996fbb3179c83844a9674051385e6e3c26fb2622917351846b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_overlapped.pyd

Filesize
49KB

MD5
7db2b9d0fd06f7bd7e32b52bd626f1ce

SHA1
6756c6adf03d4887f8be371954ef9179b2df78cd

SHA256
24f9971debbd864e3ba615a89d2c5b0e818f9ab2be4081499bc877761992c814

SHA512
5b3f55c89056c0bf816c480ed7f8aad943a5ca07bd9b9948f0aa7163664d462c3c46d233ee11dd101ce46dc8a53b29e8341e227fe462e81d29e257a6897a5f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_overlapped.pyd

Filesize
49KB

MD5
7db2b9d0fd06f7bd7e32b52bd626f1ce

SHA1
6756c6adf03d4887f8be371954ef9179b2df78cd

SHA256
24f9971debbd864e3ba615a89d2c5b0e818f9ab2be4081499bc877761992c814

SHA512
5b3f55c89056c0bf816c480ed7f8aad943a5ca07bd9b9948f0aa7163664d462c3c46d233ee11dd101ce46dc8a53b29e8341e227fe462e81d29e257a6897a5f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_queue.pyd

Filesize
31KB

MD5
06248702a6cd9d2dd20c0b1c6b02174d

SHA1
3f14d8af944fe0d35d17701033ff1501049e856f

SHA256
ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93

SHA512
5b22bbff56a8b48655332ebd77387d307f5c0a526626f3654267a34bc4863d8afaf08ff3946606f3cf00b660530389c37bdfac91843808dbebc7373040fec4c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_queue.pyd

Filesize
31KB

MD5
06248702a6cd9d2dd20c0b1c6b02174d

SHA1
3f14d8af944fe0d35d17701033ff1501049e856f

SHA256
ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93

SHA512
5b22bbff56a8b48655332ebd77387d307f5c0a526626f3654267a34bc4863d8afaf08ff3946606f3cf00b660530389c37bdfac91843808dbebc7373040fec4c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_socket.pyd

Filesize
77KB

MD5
26dd19a1f5285712068b9e41808e8fa0

SHA1
90c9a112dd34d45256b4f2ed38c1cbbc9f24dba5

SHA256
eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220

SHA512
173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_socket.pyd

Filesize
77KB

MD5
26dd19a1f5285712068b9e41808e8fa0

SHA1
90c9a112dd34d45256b4f2ed38c1cbbc9f24dba5

SHA256
eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220

SHA512
173e1eda05d297d7da2193e8566201f05428437adcac80aecefe80f82d46295b15ce10990b5c080325dc59a432a587eef84a15ec688a62b82493ad501a1e4520

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_sqlite3.pyd

Filesize
117KB

MD5
ffb03c18ed0f340fe9d86abaa9eef835

SHA1
d6295d7a100414ce76797c826d2d3c0b4df0c80e

SHA256
1d4e17237a10b68d16634fc9698edf342b40478d92fa15d574d212c7a44b05bb

SHA512
e911ce6e6b5de50696d7e7f14560c90b83c1179a946d2f5ddcf6fcf797c031dc65b42300685e97cfdc592bae5f974cc31c81d2e12994cd9c28d3f67df282dda5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_sqlite3.pyd

Filesize
117KB

MD5
ffb03c18ed0f340fe9d86abaa9eef835

SHA1
d6295d7a100414ce76797c826d2d3c0b4df0c80e

SHA256
1d4e17237a10b68d16634fc9698edf342b40478d92fa15d574d212c7a44b05bb

SHA512
e911ce6e6b5de50696d7e7f14560c90b83c1179a946d2f5ddcf6fcf797c031dc65b42300685e97cfdc592bae5f974cc31c81d2e12994cd9c28d3f67df282dda5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_ssl.pyd

Filesize
157KB

MD5
ab0e4fbffb6977d0196c7d50bc76cf2d

SHA1
680e581c27d67cd1545c810dbb175c2a2a4ef714

SHA256
680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70

SHA512
2bff84a8ec7a26dde8d1bb09792ead8636009c8ef3fa68300a75420197cd7b6c8eaaf8db6a5f97442723e5228afa62961f002948e0eeee8c957c6517547dffba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\_ssl.pyd

Filesize
157KB

MD5
ab0e4fbffb6977d0196c7d50bc76cf2d

SHA1
680e581c27d67cd1545c810dbb175c2a2a4ef714

SHA256
680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70

SHA512
2bff84a8ec7a26dde8d1bb09792ead8636009c8ef3fa68300a75420197cd7b6c8eaaf8db6a5f97442723e5228afa62961f002948e0eeee8c957c6517547dffba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\base_library.zip

Filesize
1.7MB

MD5
ebb4f1a115f0692698b5640869f30853

SHA1
9ba77340a6a32af08899e7f3c97841724dd78c3f

SHA256
4ab0deb6a298d14a0f50d55dc6ce5673b6c5320817ec255acf282191642a4576

SHA512
3f6ba7d86c9f292344f4ad196f4ae863bf936578dd7cfac7dc4aaf05c2c78e68d5f813c4ed36048b6678451f1717deeb77493d8557ee6778c6a70beb5294d21a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\charset_normalizer\md.cp311-win_amd64.pyd

Filesize
10KB

MD5
fa50d9f8bce6bd13652f5090e7b82c4d

SHA1
ee137da302a43c2f46d4323e98ffd46d92cf4bef

SHA256
fff69928dea1432e0c7cb1225ab96f94fd38d5d852de9a6bb8bf30b7d2bedceb

SHA512
341cec015e74348eab30d86ebb35c028519703006814a2ecd19b9fe5e6fcb05eda6dde0aaf4fe624d254b0d0180ec32adf3b93ee96295f8f0f4c9d4ed27a7c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\charset_normalizer\md.cp311-win_amd64.pyd

Filesize
10KB

MD5
fa50d9f8bce6bd13652f5090e7b82c4d

SHA1
ee137da302a43c2f46d4323e98ffd46d92cf4bef

SHA256
fff69928dea1432e0c7cb1225ab96f94fd38d5d852de9a6bb8bf30b7d2bedceb

SHA512
341cec015e74348eab30d86ebb35c028519703006814a2ecd19b9fe5e6fcb05eda6dde0aaf4fe624d254b0d0180ec32adf3b93ee96295f8f0f4c9d4ed27a7c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Filesize
113KB

MD5
2d1f2ffd0fecf96a053043daad99a5df

SHA1
b03d5f889e55e802d3802d0f0caa4d29c538406b

SHA256
207bbae9ddf8bdd64e65a8d600fe1dd0465f2afcd6dc6e28d4d55887cd6cbd13

SHA512
4f7d68f241a7f581e143a010c78113154072c63adff5f200ef67eb34d766d14ce872d53183eb2b96b1895aa9c8d4ca82ee5e61e1c5e655ff5be56970be9ebe3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Filesize
113KB

MD5
2d1f2ffd0fecf96a053043daad99a5df

SHA1
b03d5f889e55e802d3802d0f0caa4d29c538406b

SHA256
207bbae9ddf8bdd64e65a8d600fe1dd0465f2afcd6dc6e28d4d55887cd6cbd13

SHA512
4f7d68f241a7f581e143a010c78113154072c63adff5f200ef67eb34d766d14ce872d53183eb2b96b1895aa9c8d4ca82ee5e61e1c5e655ff5be56970be9ebe3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\libcrypto-1_1.dll

Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\libcrypto-1_1.dll

Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\libcrypto-1_1.dll

Filesize
3.3MB

MD5
9d7a0c99256c50afd5b0560ba2548930

SHA1
76bd9f13597a46f5283aa35c30b53c21976d0824

SHA256
9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

SHA512
cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\libssl-1_1.dll

Filesize
688KB

MD5
bec0f86f9da765e2a02c9237259a7898

SHA1
3caa604c3fff88e71f489977e4293a488fb5671c

SHA256
d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

SHA512
ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\libssl-1_1.dll

Filesize
688KB

MD5
bec0f86f9da765e2a02c9237259a7898

SHA1
3caa604c3fff88e71f489977e4293a488fb5671c

SHA256
d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

SHA512
ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\psutil\_psutil_windows.pyd

Filesize
76KB

MD5
ebefbc98d468560b222f2d2d30ebb95c

SHA1
ee267e3a6e5bed1a15055451efcccac327d2bc43

SHA256
67c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478

SHA512
ab9f949adfe9475b0ba8c37fa14b0705923f79c8a10b81446abc448ad38d5d55516f729b570d641926610c99df834223567c1efde166e6a0f805c9e2a35556e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\psutil\_psutil_windows.pyd

Filesize
76KB

MD5
ebefbc98d468560b222f2d2d30ebb95c

SHA1
ee267e3a6e5bed1a15055451efcccac327d2bc43

SHA256
67c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478

SHA512
ab9f949adfe9475b0ba8c37fa14b0705923f79c8a10b81446abc448ad38d5d55516f729b570d641926610c99df834223567c1efde166e6a0f805c9e2a35556e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\pyexpat.pyd

Filesize
194KB

MD5
48e6930e3095f5a2dcf9baa67098acfb

SHA1
ddcd143f386e74e9820a3f838058c4caa7123a65

SHA256
c1ed7017ce55119df27563d470e7dc3fb29234a7f3cd5fc82d317b6fe559300b

SHA512
b50f42f6c7ddbd64bf0ff37f40b8036d253a235fb67693a7f1ed096f5c3b94c2bde67d0db63d84a8c710505a891b43f913e1b1044c42b0f5f333d0fe0386a62c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\pyexpat.pyd

Filesize
194KB

MD5
48e6930e3095f5a2dcf9baa67098acfb

SHA1
ddcd143f386e74e9820a3f838058c4caa7123a65

SHA256
c1ed7017ce55119df27563d470e7dc3fb29234a7f3cd5fc82d317b6fe559300b

SHA512
b50f42f6c7ddbd64bf0ff37f40b8036d253a235fb67693a7f1ed096f5c3b94c2bde67d0db63d84a8c710505a891b43f913e1b1044c42b0f5f333d0fe0386a62c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\python3.DLL

Filesize
65KB

MD5
7442c154565f1956d409092ede9cc310

SHA1
c72f9c99ea56c8fb269b4d6b3507b67e80269c2d

SHA256
95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b

SHA512
2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\python3.dll

Filesize
65KB

MD5
7442c154565f1956d409092ede9cc310

SHA1
c72f9c99ea56c8fb269b4d6b3507b67e80269c2d

SHA256
95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b

SHA512
2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\python3.dll

Filesize
65KB

MD5
7442c154565f1956d409092ede9cc310

SHA1
c72f9c99ea56c8fb269b4d6b3507b67e80269c2d

SHA256
95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b

SHA512
2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\python311.dll

Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\python311.dll

Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\pywin32_system32\pythoncom311.dll

Filesize
654KB

MD5
f98264f2dacfc8e299391ed1180ab493

SHA1
849551b6d9142bf983e816fef4c05e639d2c1018

SHA256
0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b

SHA512
6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\pywin32_system32\pythoncom311.dll

Filesize
654KB

MD5
f98264f2dacfc8e299391ed1180ab493

SHA1
849551b6d9142bf983e816fef4c05e639d2c1018

SHA256
0fe49ec1143a0efe168809c9d48fe3e857e2ac39b19db3fd8718c56a4056696b

SHA512
6bb3dbd9f4d3e6b7bd294f3cb8b2ef4c29b9eff85c0cfd5e2d2465be909014a7b2ecd3dc06265b1b58196892bb04d3e6b0aa4b2ccbf3a716e0ff950eb28db11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\pywin32_system32\pywintypes311.dll

Filesize
131KB

MD5
90b786dc6795d8ad0870e290349b5b52

SHA1
592c54e67cf5d2d884339e7a8d7a21e003e6482f

SHA256
89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

SHA512
c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\pywin32_system32\pywintypes311.dll

Filesize
131KB

MD5
90b786dc6795d8ad0870e290349b5b52

SHA1
592c54e67cf5d2d884339e7a8d7a21e003e6482f

SHA256
89f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a

SHA512
c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\select.pyd

Filesize
29KB

MD5
756c95d4d9b7820b00a3099faf3f4f51

SHA1
893954a45c75fb45fe8048a804990ca33f7c072d

SHA256
13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a

SHA512
0f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\select.pyd

Filesize
29KB

MD5
756c95d4d9b7820b00a3099faf3f4f51

SHA1
893954a45c75fb45fe8048a804990ca33f7c072d

SHA256
13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a

SHA512
0f54f0262cf8d71f00bf5666eb15541c6ecc5246cd298efd3b7dd39cdd29553a8242d204c42cfb28c537c3d61580153200373c34a94769f102b3baa288f6c398

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\sqlite3.dll

Filesize
1.4MB

MD5
35f55e2ad0ae11a273408cfeff75b1ab

SHA1
672bff2dea4351e1245806e6af7f1be5da9dd055

SHA256
919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5

SHA512
b84a42b42a710cd5fe91def37207200141a03a8e93488d05099115f16961255248aa74c3a9800a82a0c4eb79348b570ca1a2bfa4e3168b5359ce063a688d26a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\sqlite3.dll

Filesize
1.4MB

MD5
35f55e2ad0ae11a273408cfeff75b1ab

SHA1
672bff2dea4351e1245806e6af7f1be5da9dd055

SHA256
919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5

SHA512
b84a42b42a710cd5fe91def37207200141a03a8e93488d05099115f16961255248aa74c3a9800a82a0c4eb79348b570ca1a2bfa4e3168b5359ce063a688d26a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\unicodedata.pyd

Filesize
1.1MB

MD5
58f7988b50cba7b793884f580c7083e1

SHA1
d52c06b19861f074e41d8b521938dee8b56c1f2e

SHA256
e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1

SHA512
397fa46b90582f8a8cd7df23b722204c38544717bf546837c45e138b39112f33a1850be790e248fca5b5ecd9ed7c91cd1af1864f72717d9805c486db0505fb9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\unicodedata.pyd

Filesize
1.1MB

MD5
58f7988b50cba7b793884f580c7083e1

SHA1
d52c06b19861f074e41d8b521938dee8b56c1f2e

SHA256
e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1

SHA512
397fa46b90582f8a8cd7df23b722204c38544717bf546837c45e138b39112f33a1850be790e248fca5b5ecd9ed7c91cd1af1864f72717d9805c486db0505fb9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\win32api.pyd

Filesize
130KB

MD5
1d6762b494dc9e60ca95f7238ae1fb14

SHA1
aa0397d96a0ed41b2f03352049dafe040d59ad5d

SHA256
fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664

SHA512
0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28162\win32api.pyd

Filesize
130KB

MD5
1d6762b494dc9e60ca95f7238ae1fb14

SHA1
aa0397d96a0ed41b2f03352049dafe040d59ad5d

SHA256
fae5323e2119a8f678055f4244177b5806c7b6b171b1945168f685631b913664

SHA512
0b561f651161a34c37ff8d115f154c52202f573d049681f8cdd7bba2e966bb8203780c19ba824b4a693ef12ef1eeef6aeeef96eb369e4b6129f1deb6b26aaa00

Download Submit
C:\Users\Admin\AppData\Local\Temp\堝霾妇碖覹艛疳菞梣秄狕滍錫嗪麟侰.exe

Filesize
305KB

MD5
616861cfda9ddef5b3fff0090aaa45d8

SHA1
bc7faeb0be99fc397dd6d896fd0f9d58aa9e27c6

SHA256
de918f62f0d6acacfeea67992deae5787d5d23ffe0bbdf7f8486ff8fffc5742e

SHA512
98daaec5c18eded91191b4f78a6749d95448db7ac35226b9e8385352302e821ee8492eac2a7b2bcd1cff89afd0d85770bfb2360e0943f50db3d765cbab9c7a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\堝霾妇碖覹艛疳菞梣秄狕滍錫嗪麟侰.exe

Filesize
305KB

MD5
616861cfda9ddef5b3fff0090aaa45d8

SHA1
bc7faeb0be99fc397dd6d896fd0f9d58aa9e27c6

SHA256
de918f62f0d6acacfeea67992deae5787d5d23ffe0bbdf7f8486ff8fffc5742e

SHA512
98daaec5c18eded91191b4f78a6749d95448db7ac35226b9e8385352302e821ee8492eac2a7b2bcd1cff89afd0d85770bfb2360e0943f50db3d765cbab9c7a22

Download Submit
C:\Users\Admin\AppData\Local\Temp\堝霾妇碖覹艛疳菞梣秄狕滍錫嗪麟侰.txt

Filesize
260B

MD5
ddb2f67f4120e65235b2837c32a288e7

SHA1
67cc6cf4de59984ca7f8788736e57aa0b2b6c30e

SHA256
3f599f277a2dcd96bd3264449903673d19bc26cde78e7b43ba0d8177a72ff85f

SHA512
b2d0a142abb1b1836368e7a13fbb79ed3ecf4d1d96b17716423e7b13d2b9dba5b572e77224a110737d776f868e0729a523825921cda345bd2b87c6abe044287c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
6dc613c2eb9816dfd6c96784edfb1f86

SHA1
717ebf568146bd96bad70a7d6fcffdbb49999422

SHA256
0e4677fce26a87e4b69952d7ba0ab095ffd8e9c73afda1127bac0cf59336f0aa

SHA512
b01a76b01bb0b58b0910809f15106efe88f92a550ca01a1da83630ad39c60b57d3323d5296db84a304dd68c7047620d5137914f5fb08b33703101d5a7e340287

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
6KB

MD5
84301d6d7a7e1c88eb894bdbb516bd3e

SHA1
faf849fc587bffda4174556b92e22c94797cf225

SHA256
76fcd748cdc2aa50c2599647aeffa8cdd9590164cdf50889e70f991c52a642b6

SHA512
581c8dfc71f78b9392ab17cb5f1dce527a4b63f261559f795184093f6f35475925ccdedc34df4a22eac65fc055a6d3e2ae015b17f8d627752e271120db736595

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
7KB

MD5
3a2f3937d5df0a1b977cd9e4c0e76be0

SHA1
c9097eadd39861aa56d79a1ec2c6c689edd634e7

SHA256
1b8c0b4c937a158c665e37aa52549f456d103ad514f72f5198323fa2da1390e0

SHA512
1d5987cb4636fecff18abd2e251d88f92d321bf5adbfa1cc8c07f5a7759f49db979aee9efbd7b89042c0097e87597cf9b20171d069dd12b5ea02251d2304874b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
7KB

MD5
299b7db25a115f4af5f00f5c63cfb9bb

SHA1
4e4c6bf8f7214055cae0ddc2a0188673217f615c

SHA256
bb1cb390d5a4cd04733a5d320d4f54935ddf224a331702ae6aa6b69385117bb6

SHA512
846d81967caa1079936c36a655d7803a2a887580ec4f31ef84cf4193e5836333c09734fb74b257df016d58983a7d2cf8efb9d03e2a27184ae258a31afc3a3160

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs-1.js

Filesize
7KB

MD5
aaaf0896422fa1c4d9558b75c9c2f5bb

SHA1
b711b4ed6645e0e4935123cb784d3978006882f2

SHA256
74555d316a67c5e4522987bbd903d890333c79fd300037a1bb3459975767118b

SHA512
7fe7d3bf9e1c3a29b9fbd09bcee04b92eecb6657e5383924a2989a8bc08ce46168c40ea83a33dbed0dad231a97af266933a333a7cde96086161798b9a22f8e86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js

Filesize
6KB

MD5
12201eb92cb93259a35fff19a92b63e3

SHA1
5e939359edf796397ac55f8795c0a945d6739973

SHA256
7d4623642834533a579ec1eea7b96a640fee71af00bc099391bdc035fcedb6b3

SHA512
6814089f2fd236af367c5ef2e135d4ef39a64b20cdc7193ab3a90c5d88e99c0258a09a0a97a8276e097644a749fb977fbad9504c473ea22ccbf93ef5a7d48ef7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\prefs.js

Filesize
7KB

MD5
cc83e65469fdcc9b187d200df1dedbe2

SHA1
e2f8fdfbe973521d6687527170ff34520b23221c

SHA256
3d99f9ade5451e4cf45982fc54d8ba7e1ecb52e72c47810900fcd06c0165e572

SHA512
e27059f1978b507c6ab0e5ea605d7a7a0a96e0adcf10377413b4c6329011e4f4dd2be09f27367e6967d81db703f2f4a559f23d5f50615d4323cd801a91d5db97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
57b5103d1585472bd3b0e6c9367b08d1

SHA1
c34bdb2d0cb6a8fa63bb1fbe9238fbc6fbaf4032

SHA256
6134dc15cc3f2007b9684e2d9a0cbc87de15ef9bba419bb09b1eadc96f083e61

SHA512
fc68fc8515e36687ea8fea653cdb34aed05131a7f438dc5278eff88a57a0e6ec13e5ba6f952bd6047e456672368e8ed8b306effea908be45aa4399b514b08e22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
43debb603b2cb7159bc2cac1f08ca63c

SHA1
792f568b527b1b75c4b990ef0114f6c2cc0080c5

SHA256
edd73d55ae305f923aadb02ec6288fa6f0c5d4a9b2fbe5488f9a79c3829109f0

SHA512
19c4ce9e8aa421d9219ee38b33cdbdb94bd20cfca6eaafea56482eb5428be19b8d461188a46eff066dbfc6e0daf766c03f9c597671625f28ed6f4f42a75c0db4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
da0755ef240ef23adf6fac7db26c93b7

SHA1
4f562d0b3a5dbf89f0b6dbee554820347e0ebc09

SHA256
69ee4c9c3e375818d89f0c24d5b15504cb98ac169c341e8175d991c009dbfcd0

SHA512
9c1c599fdd2232319abe5e83c8786553e20e36c7a4bf6b208270bc1ccebefe28659bb33c56d15e2b4d444e63f33efa4cb66640677cd0bb2b648c47802de36e8e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
6f9b3504784d3460f6f877dfb9c5e83a

SHA1
d4aeaea85bf6f0524025a4d933e2bf9b3daf1049

SHA256
7043a510ed9127b8608f3b78b8cff33610f0d1c6f2f136976dbe305029e1f2f6

SHA512
cc1190fedc5cf0835e77f8fd09942d7dc3a1e0864cb45bd64836aff3009d0db21c351d16df814dae2b70ee98e6c62f7d35ff150c4abf8137c168c5d75db75233

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
4163364743203ae9f135c92b21eac8fb

SHA1
d897c466d2a0075c1e39154f9fcc57f58cbef1a0

SHA256
a05bd212e70eb9b65e07f0ffde4c2dc5dbc15419b295a35258d0b5d727ee0402

SHA512
d8553b71fd6f57be4c1d17b0fd1d66c997d5fc2884356bf703a2999fb1b4eca6ea65d1d687dc73c66bbf7417483a802bad55367d032214bbc7d2a1ec8b9ba1db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
259715d7b53c62c467da100397220037

SHA1
15bbd3a41fbd09faaf998d9dcc59ace42da2d028

SHA256
d7b44c72705c69314b6e10291437163d2d4d73a098c83ea403a30d6364822b35

SHA512
b7a209dad6a929018cd96f5036e33686b12b406b9adaf4ee14ec279a96de6f36eb988c7a243d44ddc7a826d9a132043abc8f55cb693eabae21dcc11df8bf90a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
b287c2bc7b9253d163b67d0e80e81e4b

SHA1
39494cf6680267c5800035ee97253c015b9f1d84

SHA256
f1b41c0b5a6f4092e8b6e3490b60f454942d993e2229788ad8d9cb9460905d3b

SHA512
48dc87c2477b5b2a01ce962ba792a0d157dc4fd0a6bbde8d86ede3b7eecabcc92ef007bc6ebb9a0ddc4bfd872bbcaa972f60333fe31451609a0a7b06922508ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
10KB

MD5
c3387a9e8bc500ca74b6676b207f6854

SHA1
b468267f8e73276d5d691b98d11fe85ec6e5159b

SHA256
88ad3f68988b6acd74b4f4c51d122ca0a74013c9845f17a64a5fdec1b4c009c8

SHA512
56e7f1dc044573ad80a7d0bffd535d1212362e1bb65ac4f0cbc9f1c41dd6d05b2a42d88f611ffd821d1a594b8dff657cd34c095f0627e43c4c097878b514f53f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
2e99349a4e4e971cd5e5007b1f6258d4

SHA1
6aec201a912e8a759cf9480ad524bce1fb599f52

SHA256
786feba932620726734d2579cc83bf189861f3f516b63ab64fa8c246c9ebd4a2

SHA512
b7f0242c20643049017294c6cd8fc41be3a09928a87f69685d366289e1a34cadc07deb6ef077b91842635be41ad9427cc7475a43d431122bf69c13da6eab3051

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
7e0d883eef2ae0eda496397c61f8d047

SHA1
23e74a7790bc3252962e12ec101ab045e60a4a13

SHA256
794cb1f49c994a27b7dc98f25f5ce14549853a15436dc74a7ff8ae94b7d4e438

SHA512
5cd3a4526634b44896f6498143a42271d9936ef4c5368db4977b916a3ccb16538cf22124594d53a7aafa1fcb86f464637da02702a033d122863a556834e6f877

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
2a36c356098214b8e7a359d0ebeea920

SHA1
1cc4a9b3bce15fa21fb2724f3398a65390d12c37

SHA256
c0427d628b7e1ce5c38e80161a0afb7d9d1f284a0ad142bd720a7709a77c5615

SHA512
79efdae1d38042c1bd51fa52f605c0dd911f7ede435a5002242bcf34474a4f0974bfce69601c5e8dab2daa237f8b2afc9eb4639ad17779bc93d4a845411ef1e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i5yk3ps6.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
a5aee8c7ad031538bd2d9dd00a97744b

SHA1
cf1503c385d2ab947f47a2f7628c3417b71b8c05

SHA256
316cfba162e741efe910dfabd90c050e1089181698808e6d8b3032f8b05855d0

SHA512
0558ec22393dc0dbe489b7c2d97eb7592dd6f5c4b1ea300e283cb9efaaa65c6bd64b6ea41e1d125daf93e11d14497858345f8c7a1d6b1d80b1bc8430d8ebf1a0

Download Submit
C:\Users\Admin\Downloads\Monoxid Opener.ueYsG4O1.zip.part

Filesize
21.0MB

MD5
c0eec1f8a94a5004a53fca150fa15ca8

SHA1
8308a317a06c2ec62bd6ddcfc25bc2e51b55b7fa

SHA256
45b28098be2c17eaf73cf51e0e34be3dda0af18625e7328499b1e00334c46090

SHA512
fd9318ff37d69411e6c6bd40a34e717ff0e986cb685e26d8e9f6311e7844f966ffbe8103c66a5b41aa994b05c4970366586d0de05e8cf2e2485a480312d1b4b6

Download Submit
memory/1304-1725-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2556-2027-0x000002961DF90000-0x000002961DFB0000-memory.dmp

Filesize
128KB

Download
memory/2556-2022-0x000002961DB80000-0x000002961DBA0000-memory.dmp

Filesize
128KB

Download
memory/2556-2020-0x000002961DBC0000-0x000002961DBE0000-memory.dmp

Filesize
128KB

Download
memory/4448-2168-0x0000000035120000-0x0000000035130000-memory.dmp

Filesize
64KB

Download