Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
886s -
max time network
887s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2023, 16:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral4
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
android-x64-20230621-en
Behavioral task
behavioral5
Sample
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Resource
android-x64-arm64-20230621-en
General
-
Target
https://github.com/XPower7125/memz/archive/refs/heads/main.zip
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a15585ed-c023-4c5b-b0e8-1b0f9d5adba0.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230628163254.pma setup.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2890635272-812199704-3564780063-1000\{F60982DB-44E6-477B-8DAF-D500C6FEFD6E} svchost.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\memz-main.zip:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3220 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 2652 MEMZ.exe 1648 MEMZ.exe 2652 MEMZ.exe 1648 MEMZ.exe 3220 MEMZ.exe 4172 MEMZ.exe 3220 MEMZ.exe 4172 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 1648 MEMZ.exe 2652 MEMZ.exe 1648 MEMZ.exe 2652 MEMZ.exe 2652 MEMZ.exe 1648 MEMZ.exe 2652 MEMZ.exe 1648 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 4172 MEMZ.exe 4172 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 4536 MEMZ.exe 1648 MEMZ.exe 4536 MEMZ.exe 1648 MEMZ.exe 2652 MEMZ.exe 2652 MEMZ.exe 1648 MEMZ.exe 2652 MEMZ.exe 1648 MEMZ.exe 2652 MEMZ.exe 4536 MEMZ.exe 4536 MEMZ.exe 4172 MEMZ.exe 4172 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe 1648 MEMZ.exe 4536 MEMZ.exe 1648 MEMZ.exe 4536 MEMZ.exe 2652 MEMZ.exe 2652 MEMZ.exe 2652 MEMZ.exe 4536 MEMZ.exe 2652 MEMZ.exe 4536 MEMZ.exe 1648 MEMZ.exe 1648 MEMZ.exe 4172 MEMZ.exe 4172 MEMZ.exe 3220 MEMZ.exe 3220 MEMZ.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
pid Process 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 4872 firefox.exe Token: SeDebugPrivilege 692 Taskmgr.exe Token: SeSystemProfilePrivilege 692 Taskmgr.exe Token: SeCreateGlobalPrivilege 692 Taskmgr.exe Token: 33 692 Taskmgr.exe Token: SeIncBasePriorityPrivilege 692 Taskmgr.exe Token: 33 4560 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4560 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious use of SendNotifyMessage 51 IoCs
pid Process 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe 692 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe 4872 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4244 wrote to memory of 4872 4244 firefox.exe 86 PID 4872 wrote to memory of 3688 4872 firefox.exe 87 PID 4872 wrote to memory of 3688 4872 firefox.exe 87 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 1676 4872 firefox.exe 88 PID 4872 wrote to memory of 3828 4872 firefox.exe 89 PID 4872 wrote to memory of 3828 4872 firefox.exe 89 PID 4872 wrote to memory of 3828 4872 firefox.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/XPower7125/memz/archive/refs/heads/main.zip2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.0.808386519\1597463201" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1cc99c20-44a8-4890-844e-03a2e9f6363d} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 1932 1892f616558 gpu3⤵PID:3688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.1.242321231\870012646" -parentBuildID 20221007134813 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2b0bb8f-ea55-48e6-96f1-c1982437a1ad} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 2440 18921673558 socket3⤵
- Checks processor information in registry
PID:1676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.2.1641990446\1983682050" -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3004 -prefsLen 21789 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7915fe8a-1102-460c-9ed8-225b7ddc30db} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 3048 18932130b58 tab3⤵PID:3828
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.3.362160642\1843421530" -childID 2 -isForBrowser -prefsHandle 4072 -prefMapHandle 4068 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32d18cef-294f-4fe2-b31f-f08c739b7b74} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4084 18933810458 tab3⤵PID:5020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.4.1583837016\1580330432" -childID 3 -isForBrowser -prefsHandle 4772 -prefMapHandle 4864 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6bc5747-14c5-4a71-925b-b26e5ce31d49} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4824 1893498b758 tab3⤵PID:4744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.6.827177418\517347001" -childID 5 -isForBrowser -prefsHandle 5152 -prefMapHandle 5156 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {438409d5-6118-4d58-be94-ec76c0f684a1} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 5144 1893498d258 tab3⤵PID:404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4872.5.143097649\1020127164" -childID 4 -isForBrowser -prefsHandle 4944 -prefMapHandle 5024 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdad8b9f-a74a-4024-8fa4-f31edba0b767} 4872 "\\.\pipe\gecko-crash-server-pipe.4872" 4464 1893498ba58 tab3⤵PID:2080
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"1⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4172
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
PID:1944 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:1804
-
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:692
-
-
C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"3⤵PID:4880
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵PID:2316
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
- Modifies registry class
PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=internet+explorer+is+the+best+browser3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1768 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffab94e46f8,0x7ffab94e4708,0x7ffab94e47184⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:24⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:34⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:84⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:14⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:14⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:14⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:84⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
PID:1304 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7e7445460,0x7ff7e7445470,0x7ff7e74454805⤵PID:4584
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:84⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:14⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:14⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:14⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,271173635102527689,5268215204595221990,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:14⤵PID:3964
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
- Modifies registry class
PID:900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20163⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4460 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab94e46f8,0x7ffab94e4708,0x7ffab94e47184⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:34⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:84⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:14⤵PID:184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:14⤵PID:900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:24⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:14⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:84⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:84⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:14⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:14⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:14⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:14⤵PID:3280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:14⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:14⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:14⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5575764845553688857,1389124250534792124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:14⤵PID:1928
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+send+a+virus+to+my+friend3⤵PID:1756
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab94e46f8,0x7ffab94e4708,0x7ffab94e47184⤵PID:4428
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus.exe3⤵PID:3444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffab94e46f8,0x7ffab94e4708,0x7ffab94e47184⤵PID:3748
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
- Modifies registry class
PID:4496
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4336
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2468
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x42c 0x5001⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD55577898093952163e585fc1356275cf9
SHA1d46e9241b7e8e0b97598907a260c3c6ad7229b6a
SHA256275315a835f78d1d40d3425488d1ed277924ddf5200cfc9635bf24afdf083cf5
SHA51200a66c6a214f0a35144217c7738a237e41e7b9b5f66ecf9a94baf487e2b90533070092eb6930247532a7907f5415cc842d51758d3a76a48568f476ef30f1cb01
-
Filesize
152B
MD52ac5b2455c0fbd55cbc2cf7a185f6fbf
SHA1b76bbbd1265ccf5ea07e682c35430ab2a0e5dcc9
SHA256d11900a7b4bfcce0cfbf9d48fd5099d02142b9db54951b22e001adf077f7fb82
SHA5120c174d555a16bb4f874e15585b2c3c1109b7e52b0fd8021e18212d0e9ca3e09ebe570f9878b452882ef4d685787bde0a1bc9726d658a82caa677d88fd9bd7588
-
Filesize
152B
MD52ac5b2455c0fbd55cbc2cf7a185f6fbf
SHA1b76bbbd1265ccf5ea07e682c35430ab2a0e5dcc9
SHA256d11900a7b4bfcce0cfbf9d48fd5099d02142b9db54951b22e001adf077f7fb82
SHA5120c174d555a16bb4f874e15585b2c3c1109b7e52b0fd8021e18212d0e9ca3e09ebe570f9878b452882ef4d685787bde0a1bc9726d658a82caa677d88fd9bd7588
-
Filesize
152B
MD56d94050627b02fdf6bf7fa43c7113f42
SHA14bcbec6195ad805e4c60b5ba9f399163bac5ca4c
SHA2560810ee08e9c1354aa9ab43fc0784752deb6d56308df5bbb8a4b7d98459714eeb
SHA512032fc34ab45aa17d7532ca701f1d2f43f33d405efae953c4131be57901350af6dd231a4894e08939a5ea147cd6c3aec51579d5cd250cf7d06d544d9de15affe3
-
Filesize
152B
MD57f557cc9e0cbeba4b2a2329e588bcc3a
SHA1f63e735daefef5d42e2596d2d9db7e8f8abf3334
SHA2560ab2c57b249af29eb81824da4a403ac574965e17c5dbc9093c32137d3ea46b8f
SHA5129eb0831ba0de035656f836870afb866df7c6fd8ca74d921500afb48e917d7702502081b2eef4783b58be789593b0632a4de3db1516f0babf86a529f9771c3fbf
-
Filesize
171KB
MD5bd9fabb2e7434eb9ebab7b28e33ec6e3
SHA1a1cac8dd06b30bbec8c1f4c7348dd25ad4849cf3
SHA256f6711de5a380979c740e0e42170aa58a07e1ed63b31a606b77844fc8461a31ff
SHA5122395c72fb091a739f132ea2fcf8a34c85d5dd7935a9bdb0803df900b108085e79689f240acce0174b89e14387d21f8ac9bc1de6e3e85a13da7e96a47b05c830d
-
Filesize
256KB
MD5bb72b6dee04c074902244d72c11ac971
SHA112ec79993508edd16c8e07612cee43b125e273ea
SHA2568a4be553b27cc3b3aaa0a12d11ea259b70aabf98aede54d7a7e32395f646ec18
SHA51287b23171231db0bd3bd4fe50b42be2091b20226b762b7aaee1ca24ad279d99e6e1e7a6ebbc7b9c1ec2c03fde9f808014168415feb5749f18ba2867740f78f69b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD546aacbb6b08bac1dcbcbc4b27e935fbe
SHA12198c1db7bbfe90f2436a46b2d4f79c17f9916da
SHA2565a9caf7c2db1ac7bf32a0e5a1f8cc22f6c5f328b2dbaa2d8ab01640f91136a8d
SHA51263d43defa37e4c3671e7684d32a0385196c3591cd5c598c1938cecb40a09f1b38db673992375978598caff5ca9e2892548c49f57356301a56f3788a6d05c7a43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD546aacbb6b08bac1dcbcbc4b27e935fbe
SHA12198c1db7bbfe90f2436a46b2d4f79c17f9916da
SHA2565a9caf7c2db1ac7bf32a0e5a1f8cc22f6c5f328b2dbaa2d8ab01640f91136a8d
SHA51263d43defa37e4c3671e7684d32a0385196c3591cd5c598c1938cecb40a09f1b38db673992375978598caff5ca9e2892548c49f57356301a56f3788a6d05c7a43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5a22cb836d07678c661a28c5f0e5a84f0
SHA158850c5f2608d00f6149584db0344324238790e5
SHA256d5682ac37a89045e94ab81e84e0a1f33ce0d989dd7833c6124707a00c13ee7f3
SHA5128c0ee5100dd030d8f8008008426d324698ae23e1926e07f7246aa5062fcf6de0e2b7fcad6c0b63b7f50d1e493d2efc3e1b8c290e42de933634661153c1d66340
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5bfd296d4606e9186d88c11a8910c7aaf
SHA19586ebdef31dbcc8a4ad0c1bd9a76418bfebd252
SHA2560efd8af808ce77208af672e9589698610790307029edc324772597ad09048805
SHA51232f8aa337acba2532be2716e892cdb3dd42b64e0147bd00ed82ea9b665e5343d5c55340ed03e4cc1e4fe9300df5633dc53450a5534b3201aa64d1f5a83cab356
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD57e71e5e1a542567825837078cc53479d
SHA1de13717bf793cc62ec2401ff10a0d263cef1c71a
SHA2565092093b292d6ed7e628e4a2559995ae7504ded075c55158165e2ec3b76f626c
SHA51268d9a323e660532043c3cdf9f8035e19d75e8247fa3fdbe62255c41cefb6fc68ffb4fbfae1508d7cfcff521235ec48c800a6801325474af55403a278959b44d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe624b7b.TMP
Filesize48B
MD5167f1c6cc46bbf652d829cfed9f2e2a2
SHA124105ab142d945d2daea2ae5d83848f116563363
SHA25644a568e0a437ad16e61733a0c88eba628c4df196f0925ff6ecf13a784d2061b4
SHA51295b0a56a8891fe8ce510a5c917756821c833b5952c9219628f7e046c8f6ea0ed06091fa6e04918af7351e0b68993b280d9f8920bea7420f63f5258db49e40e4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Filesize48B
MD51fb7196ba8a61de55293902f668f42d5
SHA1c023d832cc3bc9197a3557f02c161cd6bbced0a7
SHA256d6ae7b52299f7a6f6aa50eeb4fdb3c6b975839064d82870168ebf8c9220b71f5
SHA51267354e2367b9701128d9354ac38cfa419acf25c8188b0192bbca1d3a247240620d2298682d988fea8b567202d316ef1a0ad93f2b15e0108342404c68de1880ec
-
Filesize
20KB
MD5c543fe65960aeb2a240b4e611ce19fde
SHA1a24dc1e615c3a72c90ca343f08233991eae4e3b1
SHA2563efedfcbc80791af9e079b03cefbae7246c99a7b13889d4438bb121ad767ab9c
SHA5127d96a5366b1329382d2baa06eba67cdc0d946febfc5d5f97e8e1d4ff98384580a6cbe99fa1a3a8ddef3070447bb37eb6bd0e1126733bb1e7835db9870fc17857
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
279B
MD5e0ca541650a373784333eff718015450
SHA1f013a347a14ab6c9300542ebf49ef11598ffaeaa
SHA256d152809064c0664fbf2b0e2ae0af7640ca474b46b725d2b1c5ba125a011e1c8e
SHA512e59bc5eef4f3cd141cbde7821084ab380625ed9f41e76035f51844cf458a02cd75c46cf5e9a07d33ab3278ab02f77e3f6d86969f90a1bfbdb0901c363612f395
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
20KB
MD5cca3eef500b0270a0d1d0cf2ca0f70e8
SHA166e0d4cff46472d0ec450bf8605735545ad6853f
SHA2569671867d37344ede67a35cfc59961fa61c6dc4fddf6b49d425913f410975a0b2
SHA512155048861dbcfe4f76b92427817ed6b6a1f56444e369b1b053713556b347e1644ae7c0f7bba95fff709b2a5be032362efcdd9a4820efb9f1a0cfc2b47bc2fea0
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
256KB
MD5c727b4d8a45f1f4cf1b5d94bf86ad3d7
SHA154c53ef3bf83ef54b96baceef60f8fc6b26c97b6
SHA256901b536f6478168ba1e6b7473581628f40539a4bd0d11809ab3cf26dce33882d
SHA5125c08755e5ef4e1c0ea8dfc195c15e12bc062d24931a6e971a060b61189e062b40af4155e4ab234e3806b0d6b131a62f92f7f3be782d7acdadec018e10a0f1286
-
Filesize
124KB
MD5d80b033cc41586c80108ea3ff765d477
SHA18281120ef786eda12e3ca330a0f1397645f2c264
SHA25612cdb251002f1d79bb2bab2e93bd772f5cf1120995666e27ee552b617aca287c
SHA512c58410eba711addadec35b69b0fc74f45612ab233f8cf6563330434fe417e8fb2ea249a57d4339c87a8ff04cb6215f861ad2b7cc369b5cab308a098a00d7cc2d
-
Filesize
6B
MD5a9851aa4c3c8af2d1bd8834201b2ba51
SHA1fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA256e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
SHA51241a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
-
Filesize
125B
MD52220e548c017feb54825600d2e173ae8
SHA1afcf7eef57d1910f984ffa6194a7bcf35cd2f1a8
SHA256e466ef3556717bda0b49ce787b69b5d8b0e13968b9c22b1e659cf18f6218ce40
SHA5120e9c7b09f4b58b91674f0f6a296aaaf44d5a3498b7d4198110ee232369429bba9a4b9954849e1e4d68244d7fd03edb63626f40896fb1740e262330feac53f10c
-
Filesize
331B
MD5f37882deea00afc25f9b7796d8d19dc8
SHA148e133c24523387bb856b6239732b57a7b242d60
SHA2563d3e4c299c215228e342b6e2afac35bd61eff7c03141475885f10402b86df3cd
SHA512f8a88c3ad47d95d37f036630912d15978cf4200221c9df40ecf2da1128075258d5a2a95d1d938e866b9406c41ba70a01e74416f4afc1b51c138a12083275c1d0
-
Filesize
2KB
MD5b9469cee81136cfdf5666010c2a088e7
SHA1dbdac54a704497f5a3e9121a71fc501b493aa37f
SHA256eafe658fa56dbbd4391cb7defe31e43855b1c4ea1bbc114d1c5f24a3d06d1138
SHA51286ff57749355d3d18b807f3d2817ee9c0be0631ead387d9c4aece884e1459c88d2aa27b3928dba7b98b07e9deca0ba8014328efe1d4995abd7585071d6acd629
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD5512707f175406dc3140361711cfc2700
SHA18adc9e737799a173d41cbb7391ba8b948f01bd82
SHA256d605702c02be24641952bb7f2830995af18e8f324a91770f237ce9d882190548
SHA51202b7f14fec692b2f669c12008e46a50818b3ed241ccf1772a9d73a4a8b478b187ce13fb28d0cbdd613d93063ec2ab23dd9a76cc1c96538e187509bcd144e1825
-
Filesize
1KB
MD5cc6e1cc7ddd71fa0a58fc9ec4d3ad2a4
SHA1ffa59cec329fc8cd46a1117a2b93997d7aa92371
SHA25646f8a9758d93b918a2ad595cbceec13bc06bc97346b41adacd9c30207db1fbda
SHA51296913305ae6470135f72b71896ecd01bb65452bf62e8559309bd417df3f7ee06736e52daf8bfc3c44ad389e68c836d8032d8fa0c7d3b0c5c324afa62cf860851
-
Filesize
5KB
MD5da16d10b22df3c649a62a894d7926ea0
SHA1d6765b57f82fc26d5ad01dbcbc2be1b1879135b3
SHA256d17e28b8569cde24f477b930f4ea6a152ba20a76acf3bd7235118e4b03588d5a
SHA512215d119df0d1a43643a8b93e6b2bb40ff3d32b0540b0892800cdeab7da1efd84ea88e5525de86e50bc7de9e2c95ac8a4ac3f117ba0c8e68998aa32e6467414c1
-
Filesize
6KB
MD5ecddfe05a1c83a980ff072c04082f302
SHA1d5a709c9fbfc80c4885badecac054de5012be6c7
SHA256662ebbc9cbbda2ee4c7ba4b3bc8bd0d4ad518f92c4f757e5726f9faefd813e63
SHA512d58b3ad046ddd234d86764c5f938a47d6a1c21f4e2c15cdf63e9c82dbeda5ec92f5c0640790c90666bf23f7f2a642dd6e403ba6f430d63ed050d9b8239192e3a
-
Filesize
6KB
MD5ecddfe05a1c83a980ff072c04082f302
SHA1d5a709c9fbfc80c4885badecac054de5012be6c7
SHA256662ebbc9cbbda2ee4c7ba4b3bc8bd0d4ad518f92c4f757e5726f9faefd813e63
SHA512d58b3ad046ddd234d86764c5f938a47d6a1c21f4e2c15cdf63e9c82dbeda5ec92f5c0640790c90666bf23f7f2a642dd6e403ba6f430d63ed050d9b8239192e3a
-
Filesize
5KB
MD584d6840875a7aae6b32991547315562c
SHA14bd743bd7e72f263a2d751f8be79557b84790e9a
SHA256e737229b10e443b823e536972c27e46ffdfc9a4e1225158399bc7dc5020dc3c7
SHA51281fb0173cf4ebc7ace6557e1d26a259e68e6f6d951a6243daa1dc327896321786691a10ed2827a8070e7f50e645823c298dea4f49708488a45e99e05c47b0eed
-
Filesize
6KB
MD5ba7a79782c602b0bb6c879016232d00c
SHA19f37b7dd9b06838920da85ce33de48acb38ba5af
SHA256f73e52d404073cdeb4769d89abac738727f48305a1646fbe01f9e4a0992cd1c1
SHA5127c1e614cf8e121c706654abcf56d6f2cd9f5c1eab4c6ad504424e9934c14948145c82ffd7d5647a8182efd0b4602a68840f76c4b497ff1d735a97ba766de3e2f
-
Filesize
7KB
MD5f44da21a8e249c128b3268995d59e1a5
SHA149d3843bc327d0480db81db5b158463a369df3f7
SHA256adf04db3c9380c1e15f1f585810ca5da38ef660b4049305c1c7190f8b93c21ea
SHA5121a422999507f33ca5ca33c815f9fea8f08b505c217dd641dd6a3b62a7bfba49d5a46fd408364369e26d684ea17ab8bd42e6c04a85a81f142d302067f2a010063
-
Filesize
7KB
MD54451d4bfe74a5df6403315c4b51f67f9
SHA1fc336df8d4d02e73bfe84f5b145220e601c2f9b6
SHA256f28dfe562d00469167aef00f234ee1f24eac0fffa2bdc4824bc194d2f03781b3
SHA512f3d1a01bdef59c9fa5ff6aa4cfe84f402400bf42e2673680ddd50e371ac876efaa8770c992f33cfd01f33be77e4a9e33ada0f4cba74a1bb440f8d70eee6485a9
-
Filesize
7KB
MD5ecc4c480e99c76380d08b144d7f29015
SHA1b7aba07ca1b09d66bfd1593d799fd8a6727589a2
SHA256efdef403b6437283305f31bc53f74d17c75a029944a7a51bbfaa86439c6a1fe4
SHA5121f84e9011c9e8b4e72f9375b92580b24780bf7245ceb7ff1f376858751834e49c8ee69d5cb3093042a9e5ca5609a83ea337b683a8038ffb4ac40fc4b4bae734b
-
Filesize
24KB
MD5aefc5ee3f7d446e4f589d384871089fa
SHA1f473772b9fad6deed5ac5ab67e21e80a32beea15
SHA256cafbd5930c58521f476407f52bc923d7ad33b37e5dbff9be9b1d6b28249d0ad8
SHA512697ff96fe24ee7016dcfead1ed557b89f2123306749939ac0bf8bc09eae97fbb040314d59991482dad192006a278343cd1176cecdd79a0cb98138611e81bb02f
-
Filesize
24KB
MD5bfb396f724d87b5dc03bf360219fa3b0
SHA15c110515ef78880ca230a1d418b6ee92a3565e4d
SHA2564a0f5896f8b14c1d99f37e76192d6d84c433000d50a7b5ec831d1ebecfbf2264
SHA5128bdc70b2413a4e8ddc1b72fe4628106f76e7a5246c113575aca817ff6dce051f945016eac9e8bf342716c1a0862a737c015cc933c13e44a013555ddfff6f527f
-
Filesize
24KB
MD5049359a5acc348e165be950d43074bbb
SHA1e98161054f46dd343d437b99788fbfcd20bdea50
SHA2567fcb73e5f8e53cf430ea358048978c748bc5fd5fe1d14714d78c153d98a280d1
SHA51297881bffa767ef1317541faec8c0e808169701a22abe163e937c61be8ce62cffbcaf8443259d4f5b991f40ca577a6823c4bdea0ecf40be69519adbac07d26ddd
-
Filesize
728B
MD53501875e2e486991280dba014de998e3
SHA1e6359aea5bccc361cdb0398f380f86565140dc69
SHA25673ab0402677a81b860d7a655ac149dbca61aefb4b6e1aba3922d438d62e4ea39
SHA5128c7f345e397e46236b119e22f0aa327aa6fb6bc40d49a64033b7a85684fb2105847ca35bbc8c6f52d62f1550511105179aa42abdd33aa7c3225baa1ceb987187
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
279B
MD5b567bba54225f34bde5198db13ec7f1f
SHA1e02317ba75a13abc3e2d662313340bfa3e3ec85d
SHA25629ada5d3f08664ffb5e3ee1c11321d989c9602af0f90eb149cdd17a0d475c984
SHA512e336c0bfab15438e97f97483285d67826e294d392674fb039fac89a795abce244e176b202090e3eef2e75bb9c05bcdb1b8f5ab0ec7759ee1c8856342c132d0b8
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD5e7fcec366f0b81bff3b680d9ff05958c
SHA187cc13e13355a8872e3e1da5bdf570a69d859006
SHA256b71eea5021ba5dae45d7c8fe6688a0545fe44ee7493772aff15467da8cd39b20
SHA512b8c3a3f5631e65298025a33dc98d1c0df2868fa13bf04f63e58b2627aecd78760f11b0f1ebfe5fe8d3e933f0bfc8a9cd47ce4272feffc0e26340ee56d5aa5e4f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Filesize112B
MD52580762b36afbdfd80b610ec9a94f12c
SHA14830d20f5ac3046ad7beefa00d6a917859df0e22
SHA256cdee615b796a9da5a1fda7fd6462b5d4ec3eeb30e4cd7fc3e84746eabf127146
SHA512c6e7ff0372bfd2b660a4969186fe8ff473ec1d320e83f9a0c15cc5189a962d18c3c44f7e94dfc8996a2bff3233926d11e64550837db7bb727b7de6537eebffde
-
Filesize
347B
MD5132634e5e32785abc182690ff2ef8862
SHA14be004c15b139f44171090e433c5bb324e65895c
SHA25660e6321aaf69c49d7576801dac8bcd33213e059112e9c1dcb42479ab55371e05
SHA512c743092f364bd4bf96fd629de8a38cdb5fccb683970fd897cb4c62bd687737100adbfa5101d2e42b0844c6c97916f9573e1042b4eabd9ccb7b2401ba18bd6967
-
Filesize
323B
MD5a7c9ef1caf19365b2f5f149c66e329f2
SHA182db34cdbe5db4ff038e3af11481643d90e53d7b
SHA256dc34acd450e5763a85081f1aaa787817934f3eac21716aaf6caa085a01ec11fe
SHA512e19e78b97ef64fb7ff299fb7a9e3a08fecc998c88349d318cd3f29897f767a5f2cb14e6208e3875bc6d746341b3ab2d78d82facb03e8d17ccb9486e49394c7d8
-
Filesize
20KB
MD5f44dc73f9788d3313e3e25140002587c
SHA15aec4edc356bc673cba64ff31148b934a41d44c4
SHA2562002c1e5693dd638d840bb9fb04d765482d06ba3106623ce90f6e8e42067a983
SHA512e556e3c32c0bc142b08e5c479bf31b6101c9200896dd7fcd74fdd39b2daeac8f6dc9ba4f09f3c6715998015af7317211082d9c811e5f9e32493c9ecd888875d7
-
Filesize
128KB
MD500141269eaf62b944b8c6682a14f8433
SHA1b04c9aa53dcd737c229744c2a54d6e3030870583
SHA256366f86b0152e4e8c5cb7041d2e3689ccacd93448add6b6637c484b7dea789d11
SHA512e638e2f45360ec662f2b56d9ad2a9fe830895ae616094f5de8a2b605b58b66554718448725040436342eada429c468dae5353806840af91166ede39022e11b7b
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
44KB
MD5f7138d290e0da6dc15f2e045b22ef98b
SHA121352442752f603b4566fdfb13f405eea72efccc
SHA256aef6b1b845faa419242837a2ccce224bdc80c3477b5425b3e16fabd2b4ada5b0
SHA51244ca19137727354d7d13f1c76361dad772e5a36c365dbe4212a8000fd687d758157e4bcd5daafee4da76bfcadd1458cef75b25e33b1cfb072d6e188672029082
-
Filesize
187B
MD543c584aeaceae63fc3f12512602c38e6
SHA1a10aa75469e43baf0146509489964a2279af945f
SHA25667718c9d638b52feceb65abfa6abbca2bd5854d862218fac9d1cab889ac6c011
SHA51269dac0fcc155b13d3f9f15def5650c948c19e187a89b4f36ad249dc88afd3b71a5b5df8a36e616142571b27214b9cbab684029b2fb4801c16bdbf08f61c761d8
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
279B
MD5bb639f0c1ead5802d6b0f583df5b49b5
SHA1d6e36f93513a082c8872d7c34c7a03fb461fb368
SHA256083264b63607d8990bddf0a5acaa96bcffa62237c5b1599584cf4b4067e5b8a7
SHA5125eeb5bad9cfc37db39dde5a98106fe4403f0363c530f06726a11978bf71744b437ffa67cd69b2a6f896a5c83311fffaab41ee6ac4afb3ef33b7495929795552f
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
560B
MD5a0ca11c680496f0d6b4911e3117f3786
SHA1211e364c5daf05e6129292576d11bb784b051d2c
SHA256ebfbad22ba7a6e025e1d9d7efbc38fdea6a7ec0a6b8f358b8578f1f44b2a040e
SHA5121b2480de3e13450c83d46626fc744d428fcacd302fc0d580f507f1042b4e05d3732536c45cfd2fa0714f1ce1fd5261265ef2441f441a086de964bdf41901054c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
297B
MD5887cc9f3151d4c1228b445a5d5b43bb6
SHA16d572930098cb53e5d6d4c59900bc6c131ce3072
SHA256a9287e9668310035b42423f1842168ac58fe41c8e56bd89ca67cc523f781c079
SHA5120d5e9a1d400c85ccd281ac3d833c0f940058a70f80d9d360a849ebd754b43b3fa80d5a593cb3b025a5c424c9bc90af326d2a14e42a8a2c293ecf64f52f954054
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
Filesize
12KB
MD5b5ea0e063613b4f6ba82cb0dfefb6c4f
SHA128b7906f2070b6b296acf4628880a200dfeb1df5
SHA25680cfc2937637e413f39440fed0c1feab52a6d6a779787f2a9366b34c5bf97990
SHA51281c3c7d9ee94eac31b61a08fc87e5302f56929d682d343289c979863cfa4ed6397f1782469712a54a917644728aed0a5bde25f902d3a36da36879d6fe7754711
-
Filesize
9KB
MD59277d1f553db6f449299779077679016
SHA17915f70b50ace2dfb1566973ca67d9267917ea17
SHA256bede474fa830a0cf7fc86f7175a5beee96c042e5c1bcd78fa2b5769d1a733025
SHA5123e9ac4e4ecd6ff5ef14e90cd3e4bcd05baad59fcdc00291a0fa249b5d95a659db8c84b45e39165de20c2369e8b8c9229ec7d472318c7cc42c29a8e24950b5d39
-
Filesize
12KB
MD58c30999926134fc51218c9c332903fa0
SHA1dbc1e634abc8f86c64d71e8614c2f764d617dda3
SHA256b1b9982bc3984af3785a8e6ed0fec392dba666f3f4891523593f2046453dd381
SHA512fccfb5adcc2594bb2f07ef8d7db7d9a041213d1151825c69dd077a967d54d554f7b0c83f6247977b2b5bd8a54f54f158d5ed32bab94db86d8f790812d831b76e
-
Filesize
13KB
MD5ee19494c9c051daf13d4a7fff7c8bbe9
SHA1f69aafc3095fddaeb874bab3f0b74f1d7f9c134b
SHA2560012d40103713ae35c1f9ed538ec9078beeda8d3efed2638f307bf4db85df6ff
SHA5124495afb3b6d065d36432b3cb520c551db258dc4a9956be53ee7bde55c868f717b870914a33369a76259cc98320c017411758471555052180362cb4df03c0dc77
-
Filesize
12KB
MD5b5ea0e063613b4f6ba82cb0dfefb6c4f
SHA128b7906f2070b6b296acf4628880a200dfeb1df5
SHA25680cfc2937637e413f39440fed0c1feab52a6d6a779787f2a9366b34c5bf97990
SHA51281c3c7d9ee94eac31b61a08fc87e5302f56929d682d343289c979863cfa4ed6397f1782469712a54a917644728aed0a5bde25f902d3a36da36879d6fe7754711
-
Filesize
13KB
MD538100b79ed7ad77e6b9d693af578511e
SHA175d3f918f076f4e54ebda618b95e959684296e97
SHA2563a9840b75539658f8ceb62c2b7c06db5fab2c26a457a9c5ef96c6e5c48e44940
SHA5120e9b13cd9ba1c9526fe6a5d3e5e5eda03f9b3f6be6841b585d46d42b6b6496992c2e29387c41131e44a9ddb28efaecd59c1082c0a8c623344a83563798f37105
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\activity-stream.discovery_stream.json.tmp
Filesize147KB
MD5e37aee410fb13b1c173612c133b4ba58
SHA1091da7a0e832886294916f0aa71dde84f58150c7
SHA256c9b3caccff2469addba68fd6eb5987663d991e5c551ef8303254bbba79a89761
SHA5120cae3de896f06250e07636aaf66573ba4110ae868e93d5bcc22f52b0bc6854ede0dcb2cf3d65cc3966786f2ee84c682a2b830306df77d6e62e21a24ad7b816f7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0
Filesize14KB
MD5fee5ffe04e0e55767f3e25a539dad729
SHA1f4abb4c2ff0251a5b3a851e6d682d597d59deab3
SHA2569d88807335b24ec71b65fddb25b4b814700f6a835feb867e8307054e7b6e90eb
SHA5122e51915aab5e11597c3a6d53eaea9fcd5adc9959c93f36f67ff497cf1c0708272a66cd69dfcee68553703f854bcdb070e960cf316d5b965744ee1f93455f1e66
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize7KB
MD5f9e556166f736de965d701891405b160
SHA19e818a5277cf8d6f2f4ef05076049aa1115f2dfc
SHA256d0f7e3228baf586c9c00651b862b5a40ca6c923002abedc78d136d1acc4c50d1
SHA512cadd472dfd850a89a231f32343e1c659c755b791c4142db1138bc0de9552b1a3a9e1242c243197e6bce56e8f176df9f3fb03e1b9713fb8b4afdae7e21081e8ea
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD55a3e133beb37bc17c9723be19cb61014
SHA1cf09fe899178755db58c805f2a4726c84653e033
SHA2567b64e835d837a62b0e708f9a7c1632f87a663e339d7ad4d7c0a7bb16efe4b884
SHA5122ba85917a68fc860da37c4cc61244316d81271ee807d0db9fecce125d2d5f99d182938bd0d4523b06db906f54cbfe94150f65aca80588dc2e94c539286865403
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
Filesize
9KB
MD52933ecfe89a7f207c8f21df744694bf5
SHA141504e9d0fc8c9f3fbff6b739d5685ca60897768
SHA256ed09a86adeb8ea8acc932f05c596876648ac0d2362f5cf4f40a4b943169544a1
SHA512671a250eea4a7a8b0e10321008ec748b28b9afd217b4c71f7708c660608cc24b6a52d839a6e7a1cf36543a81e8c81b6c446d037cad89d4cb47278bb370d1c5b6
-
Filesize
6KB
MD5acb9d0a44a23bca5a3839c0d958cf115
SHA127450f130ad36443c00179f888be74761f2a64c8
SHA256796f3b61029c6fd726d982ba3e87aa6bbdde0c7a0889c6ab027a12f5481fc17e
SHA5126ed0e9f13c387269243e4c352db5f15767b9a467c6c484d828c5fad8e6b15a5d684d1569175547b253fbe703e457c0a3f4b0b598b33889b8d128710876914519
-
Filesize
7KB
MD56d7fc800a8cad5450d8e6af972eb6d4c
SHA10882299a4c94400ee86fe0e18ed0d0d2bce76e9b
SHA256568fca628abce5da91f286cd64a723e8d62001acbdbb79adf7eb7a8e8e94d134
SHA512651cb656aff87040623fb9f203c598b80605ba8b8deb63a474821a9824e2af9aeab665732e5610d59600daf4de47214b60c438b4f0dff5f31043f07ea396097b
-
Filesize
7KB
MD5fe3ff5dc162f2f4b636b79b831376316
SHA136d3a262b2544f56ffe98ede5d095c3d0a8ce345
SHA256ded80f1c3986a55bf36dbcdf160317bad5db33026559adaca09b5e7eb0c372a8
SHA512cef5364a0a876ca7d0d4f9eae584ad4cbadda456ddd14e078e62ed3e0830e2d3cb3f613d082b746f6b9def2de0f8abb57ffad2e4644a502d37fa286e139cc00e
-
Filesize
9KB
MD571ca52670fc9a65b651a5371e7efa998
SHA1b8c645855deeaedfc9b100040745507fee8e0ac2
SHA256ef657e29d030624a0ce1a18c1f97d31096f8b3fe258db181b5b48a2162ba3bf4
SHA512c3da2a74473c8ca55ac837d6d47af1fd4a6cf7cfc6e91c16ff1e831f2ea22bfe80c8ac3a223e4da5ad32fa5f8ccaa52d1a1d8f72dee341f4eb69e697a176c848
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1023B
MD51eb4d10757db6e772bbada3419276daa
SHA1faf1aa810e59ba0589a5d861479edb1365a70d9f
SHA256b9ec0d9d481813ff8f4fd4f607f0e3305dc84e432ca71c17f5a64d6bc50fa3eb
SHA512ce9a95892de4d227600e23f4425200b6ef3ae28861c5a76b5c8461eba86f4bd215c355898e49511772a4c8d8380c0e39429307903ea22338c0169e796254fd01
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD593263f45e1279e93ae48d94054bf2207
SHA177ac33dfb03881b0fba612a3004797dd088259fb
SHA2568d275dd43642d19fd69bae91b998b424d91c9b02820e66d1f9c737fa1345b73f
SHA512bb442f0193a9eaf4af159d6f683908519b0e82000d95968a707c93ee090d8c995841487b5738b47a9caa87985d745ea09559c3c2c35b7a09e84931380575589d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\sessionstore.jsonlz4
Filesize643B
MD5ed82f27c7d066173d16698ccca7b222c
SHA1be71892ad86859451c09336ae89daf018b099d30
SHA256ca98aa7a30c313d92a68acfdb119c6d2a33f652046431e0d0ffbd5d36ff60100
SHA5125e548a516e585a9a73080a0056d31f41fa32399db98b4ae09476a0c011c0c9ab04afc72bee66937c0c28a8d9012cbd3e5617fa1cd247164b055271bb97d5ea15
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w5h9zvv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize376KB
MD5c9f2f0a17b6719c9ef5058361761b86a
SHA1ea13293e37fc64d6e133726dbfb7feacb31a2225
SHA2565f7f58ebad5cb2316b77c3d8426c247cd467a198f90ca69a1660ddb85e15cdc2
SHA512f365343ca010cd4583962937c0b83c7ab14a393f2542017a85b0e135e25ca527460db2d15eb0e0ecd535d7e1b846dd6fa1b083075eb3a0790151ce5c04dba6ec
-
Filesize
16KB
MD5103fbf0c1c832fb7893471f0fb8afe26
SHA1cfdc1a5ce3864e0049ca8b1cbe14f221aee5f9b4
SHA2567a80a9cbb48c81b3bcf3a4482acb3af6f5cd2318bfbaddf9d9581d55b0540bf2
SHA51248316225933b9fc92eee25013da06d4ddda454a0ec00e2d1dfc0af3fd31df26e6bebe49119b040449c970862794ebb9b4df460343b863a986858c957d97dd771
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf