185b8698c785ca6baa66887edb36057816345af75d8231f207b54d486f60e2ff

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/01/2024, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e4db12031f1938387633d1d75ed3a9d1.exe
Size 895KB
Sample240121-k4pbeaabbj
SHA256 185b8698c785ca6baa66887edb36057816345af75d8231f207b54d486f60e2ff
MD5 e4db12031f1938387633d1d75ed3a9d1
SHA1 0c1414b1a4b5c48f1480ff73ef56a226fcc69c46
SHA512 66a4c99823fc329791dab8d6f3fa821a121801a0cbc17b3a33fd846ed2828c5e72a02974a9c54f12f43f5a9fd53090cf62dfe3f42f4ea94e4d7f18266e67af7b
SSDEEP 12288:0qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga6Tn:0qDEvCTbMWu7rQYlBQcBiT6rprG8aKn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	e4db12031f1938387633d1d75ed3a9d1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{5B4991DF-5030-44D6-8ADE-F09DE13EFE7B}	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
904	msedge.exe
904	msedge.exe
5420	msedge.exe
5420	msedge.exe
5376	msedge.exe
5376	msedge.exe
6268	msedge.exe
6268	msedge.exe
6404	msedge.exe
6404	msedge.exe
6748	msedge.exe
6748	msedge.exe
1428	chrome.exe
1428	chrome.exe
6172	msedge.exe
6172	msedge.exe
6172	msedge.exe
6172	msedge.exe
4776	chrome.exe
4776	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe
Token: SeShutdownPrivilege	1428	chrome.exe
Token: SeCreatePagefilePrivilege	1428	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
2700	e4db12031f1938387633d1d75ed3a9d1.exe
2700	e4db12031f1938387633d1d75ed3a9d1.exe
2700	e4db12031f1938387633d1d75ed3a9d1.exe
2700	e4db12031f1938387633d1d75ed3a9d1.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe

Suspicious use of SendNotifyMessage 55 IoCs

pid	Process
2700	e4db12031f1938387633d1d75ed3a9d1.exe
2700	e4db12031f1938387633d1d75ed3a9d1.exe
2700	e4db12031f1938387633d1d75ed3a9d1.exe
2700	e4db12031f1938387633d1d75ed3a9d1.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe
1428	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4856	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 904	2700	e4db12031f1938387633d1d75ed3a9d1.exe	89
PID 2700 wrote to memory of 904	2700	e4db12031f1938387633d1d75ed3a9d1.exe	89
PID 904 wrote to memory of 4948	904	msedge.exe	91
PID 904 wrote to memory of 4948	904	msedge.exe	91
PID 2700 wrote to memory of 920	2700	e4db12031f1938387633d1d75ed3a9d1.exe	92
PID 2700 wrote to memory of 920	2700	e4db12031f1938387633d1d75ed3a9d1.exe	92
PID 920 wrote to memory of 3124	920	msedge.exe	93
PID 920 wrote to memory of 3124	920	msedge.exe	93
PID 2700 wrote to memory of 3772	2700	e4db12031f1938387633d1d75ed3a9d1.exe	94
PID 2700 wrote to memory of 3772	2700	e4db12031f1938387633d1d75ed3a9d1.exe	94
PID 3772 wrote to memory of 4368	3772	msedge.exe	95
PID 3772 wrote to memory of 4368	3772	msedge.exe	95
PID 2700 wrote to memory of 2304	2700	e4db12031f1938387633d1d75ed3a9d1.exe	96
PID 2700 wrote to memory of 2304	2700	e4db12031f1938387633d1d75ed3a9d1.exe	96
PID 2304 wrote to memory of 4816	2304	msedge.exe	97
PID 2304 wrote to memory of 4816	2304	msedge.exe	97
PID 2700 wrote to memory of 4480	2700	e4db12031f1938387633d1d75ed3a9d1.exe	98
PID 2700 wrote to memory of 4480	2700	e4db12031f1938387633d1d75ed3a9d1.exe	98
PID 4480 wrote to memory of 4664	4480	msedge.exe	99
PID 4480 wrote to memory of 4664	4480	msedge.exe	99
PID 2700 wrote to memory of 2148	2700	e4db12031f1938387633d1d75ed3a9d1.exe	100
PID 2700 wrote to memory of 2148	2700	e4db12031f1938387633d1d75ed3a9d1.exe	100
PID 2148 wrote to memory of 440	2148	msedge.exe	101
PID 2148 wrote to memory of 440	2148	msedge.exe	101
PID 2700 wrote to memory of 1428	2700	e4db12031f1938387633d1d75ed3a9d1.exe	105
PID 2700 wrote to memory of 1428	2700	e4db12031f1938387633d1d75ed3a9d1.exe	105
PID 2700 wrote to memory of 696	2700	e4db12031f1938387633d1d75ed3a9d1.exe	102
PID 2700 wrote to memory of 696	2700	e4db12031f1938387633d1d75ed3a9d1.exe	102
PID 1428 wrote to memory of 3812	1428	chrome.exe	104
PID 1428 wrote to memory of 3812	1428	chrome.exe	104
PID 696 wrote to memory of 1224	696	chrome.exe	103
PID 696 wrote to memory of 1224	696	chrome.exe	103
PID 2700 wrote to memory of 2044	2700	e4db12031f1938387633d1d75ed3a9d1.exe	106
PID 2700 wrote to memory of 2044	2700	e4db12031f1938387633d1d75ed3a9d1.exe	106
PID 2044 wrote to memory of 1816	2044	chrome.exe	108
PID 2044 wrote to memory of 1816	2044	chrome.exe	108
PID 2700 wrote to memory of 4012	2700	e4db12031f1938387633d1d75ed3a9d1.exe	107
PID 2700 wrote to memory of 4012	2700	e4db12031f1938387633d1d75ed3a9d1.exe	107
PID 2700 wrote to memory of 4856	2700	e4db12031f1938387633d1d75ed3a9d1.exe	110
PID 2700 wrote to memory of 4856	2700	e4db12031f1938387633d1d75ed3a9d1.exe	110
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 4012 wrote to memory of 1736	4012	firefox.exe	109
PID 2700 wrote to memory of 2900	2700	e4db12031f1938387633d1d75ed3a9d1.exe	117
PID 2700 wrote to memory of 2900	2700	e4db12031f1938387633d1d75ed3a9d1.exe	117
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116
PID 904 wrote to memory of 4968	904	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e4db12031f1938387633d1d75ed3a9d1.exe
"C:\Users\Admin\AppData\Local\Temp\e4db12031f1938387633d1d75ed3a9d1.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe698346f8,0x7ffe69834708,0x7ffe69834718
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3332 /prefetch:8
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
    3⤵
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
    3⤵
    PID:6504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:6584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6896 /prefetch:8
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17488863836137207157,14726363324645077413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4204 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe698346f8,0x7ffe69834708,0x7ffe69834718
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,11117597866624130000,13896340812959529820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1448,11117597866624130000,13896340812959529820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
    3⤵
    PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe698346f8,0x7ffe69834708,0x7ffe69834718
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11183825204561479983,16308107132658695575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe698346f8,0x7ffe69834708,0x7ffe69834718
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2267035805004711131,11813812455839452495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe698346f8,0x7ffe69834708,0x7ffe69834718
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,9925793758729902713,16153965101263240053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1612 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe698346f8,0x7ffe69834708,0x7ffe69834718
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1424,4694346661140383556,757283602452078034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe5a3f9758,0x7ffe5a3f9768,0x7ffe5a3f9778
    3⤵
    PID:1224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1960,i,3995883126741339262,7396532593847828482,131072 /prefetch:8
    3⤵
    PID:8096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1960,i,3995883126741339262,7396532593847828482,131072 /prefetch:2
    3⤵
    PID:8072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1684 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:8
    3⤵
    PID:7616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:1
    3⤵
    PID:7716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4040 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:1
    3⤵
    PID:8000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4864 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:1
    3⤵
    PID:8060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3800 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:1
    3⤵
    PID:7920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:1
    3⤵
    PID:7728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:8
    3⤵
    PID:7560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:2
    3⤵
    PID:7532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5324 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:8
    3⤵
    PID:6996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:8
    3⤵
    - Modifies registry class
    PID:3112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5460 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2336 --field-trial-handle=1876,i,5115770431977400639,8666462468708200653,131072 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a3f9758,0x7ffe5a3f9768,0x7ffe5a3f9778
    3⤵
    PID:1816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1952,i,16218032827395924676,4600430807874682434,131072 /prefetch:8
    3⤵
    PID:7888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1952,i,16218032827395924676,4600430807874682434,131072 /prefetch:2
    3⤵
    PID:7880
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
    3⤵
    - Checks processor information in registry
    PID:1736
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.0.102827956\2036622333" -parentBuildID 20221007134813 -prefsHandle 1776 -prefMapHandle 1768 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {000ea3a7-46aa-4e7f-a8f8-05c57bbb051e} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 1868 2118fbd4b58 gpu
    3⤵
    PID:3276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.1.1089740714\1494373554" -parentBuildID 20221007134813 -prefsHandle 2284 -prefMapHandle 2272 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7b911ef-f754-405d-8aa5-d99b34df729e} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 2344 21183cde158 socket
    3⤵
    PID:6804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.2.1495313795\2088079914" -childID 1 -isForBrowser -prefsHandle 3252 -prefMapHandle 3248 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {957a4661-112f-4d22-a523-205749146572} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 3352 2118fb5b458 tab
    3⤵
    PID:6724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.5.1092363806\885977868" -childID 4 -isForBrowser -prefsHandle 3776 -prefMapHandle 3780 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09e11aa1-76c4-4095-81a0-60729a3464a1} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 3764 21192f8eb58 tab
    3⤵
    PID:7636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.4.2099760563\1378261642" -childID 3 -isForBrowser -prefsHandle 3252 -prefMapHandle 3472 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9eae863c-f22f-483c-916a-b22b0c7cba42} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 3492 21192f8e558 tab
    3⤵
    PID:7568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.3.653253806\998991187" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3588 -prefsLen 21709 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98de2ef1-ef2a-478e-bc1d-25b19a92b8e6} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 3152 21192e3ae58 tab
    3⤵
    PID:7344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.6.150252465\681416051" -childID 5 -isForBrowser -prefsHandle 4648 -prefMapHandle 4644 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d053f76d-f7df-4331-849d-0810e9934ba9} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 4660 21195c4ee58 tab
    3⤵
    PID:6112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.9.1775471159\1002277905" -childID 8 -isForBrowser -prefsHandle 5412 -prefMapHandle 5444 -prefsLen 26300 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6410b4d9-b287-43db-947c-678af90966bb} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 5432 21197332758 tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.8.167275845\17919740" -childID 7 -isForBrowser -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 26300 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b533a816-cc71-42cd-b48a-ac9514f4c74b} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 5716 21197333f58 tab
    3⤵
    PID:3376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.7.1716973730\696393222" -childID 6 -isForBrowser -prefsHandle 5580 -prefMapHandle 5568 -prefsLen 26300 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89e3af90-16ec-41c6-b24b-62fa8fd3ed30} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 5588 21197332158 tab
    3⤵
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4856.10.395313452\1996178002" -childID 9 -isForBrowser -prefsHandle 6532 -prefMapHandle 6500 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1300 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d09fe3ef-afe3-44a8-9cff-9d1529c0aa8e} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" 6540 21192091258 tab
    3⤵
    PID:6312
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
  2⤵
  PID:2900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5a3f9758,0x7ffe5a3f9768,0x7ffe5a3f9778
1⤵
PID:3812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
1⤵
- Checks processor information in registry
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6612

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7b14abffd2823cb808b20be179788d4ae316533eaeb954fb0c0fbee8f9fe0f47
MD5 d953520eef04a7f704dfe97db53f6a7f
SHA1 55e37085e46991e0aeb58b2cc0dbc1a3c3c04e39
SHA512 630b0cf4ba960966d41b512868e6ec54db4e270fe936a2ad8ff80ab7b7cc9b021c6b7eeda83744602edcccaeb3893f87a2b2270b8ca8ba9c409e98036d5b0b85
MD5 SHA1 SHA512

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 200KB
SHA256 da48541e8cdf8b8ca356681112cbb50f4d7fb903d74536ee7df64d1a57ea3cdb
MD5 b1b234e337b610a5443185d272f840df
SHA1 085951ab961a32552aae1e6275463d04a1480e16
SHA512 a2eec2b8ccb46230bbaa94f493bbca669ff84e9d02a54e816ae02d66a3f4f8108c5d2803619fd8a8968b5a0d1406283518b35ea7ffc8f19562e32104ed369cd2
SSDEEP 3072:0ASNZT2kKOmqv3BZ4OJCsoB52KDdzRilVzv+xfHExAg67zhVqMK8/wehNj5TDGil:0AYZT2kKOm6R1os4/73p7zrjpDG+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 22KB
SHA256 d9134e3cf60db564c49cc181251c7308bc568acf060444c443a90c0f464ebfeb
MD5 7a204d478c8dfe822bf86f9103bbd9b3
SHA1 7114b36ea1588d9372d730b2ee5dec7a3aee36d1
SHA512 f5fb06a9808e9370a5fb3b926ffa27746ca7942eba36a2f63135168218e326abc74195453b9bcd8a045d5870a71b7f250dfc281515c7fa51857410acb316763e
SSDEEP 384:nvbrNYUrJVMhJyOObsMcKvg5SLUytc/i4SXOxZewvyLfgURlFj:vbRrJVMvBJMdBEuXKhQfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 202ba91d1c49c5f484ee1a0aebce6acf79d89a116c977f726bf00e62d87f3195
MD5 d4efaaabf6b30f101d16d2e151732729
SHA1 f7aa54b316b927b714c96204739c54f83dd4f5ea
SHA512 f1b683402838002430bcbb295902f9879710d5fe16e406d75ba0227305f4c7dd8000b62add3df4ab1a01cbf481929802a34275fb8ebf0f7597e99b6973dc3ed4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6176cdace043d911766d12ee64d2c4057640dd9cb720405de11b297a4b14d376
MD5 e00825a8e03bc4730cce63fc94ec221f
SHA1 0473ebf2929afdb7d18c11214f47380bfe4e33fa
SHA512 7f878034de1304ecbd410f5fc9f2fb2672be9b4ff394ab8ba869d42faadc2f86c71edaff4367f502448aa63e802216c3b9c0b27311b5979849e2d97bba932c98
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7d019b9513b6b6b4f4d940b490f0234fa61dcf363a744e2deed0c63f03a53440
MD5 82713f0673dd1edfbc1ce87cf48a7020
SHA1 22e3df1b5f45ffd71736d66ae6abd3ed0aca6213
SHA512 5d09260b1059f9237e4ea5c973039e6cdbb8b8a3960920e31961c72f05d6bc6fc784d038e6a24b4d2b4af9ef4db4644492e6083950dad43b831223961dce36f3
SSDEEP 96:J+XHeZRr13DG13XGDGLGpkGp6GcGgGIGkGWG/G0wBoG:J+XHeZR5TW3X4ADbxxZbV0iBl
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 66ab2f83ee37fd27fe42219abd6c9b65103018f7d2382be192b9d2471d2abd19
MD5 07d320606c4c4f97e3879056e65467ff
SHA1 f77387a813a3daaaf36e0ae610decbcd4e58fe73
SHA512 12884b36755ead7998ffaebeaa9a1fc57f87d8b9d12b7f88666f957dd9b65b7626afd814ff92e56f380a75d960b1ab34231eb8f43d6f3ee534693aa676d192c2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 874B
SHA256 2221e96fac573ce69a8701302062b67a129c5e4c963eda4b22d528976795ad5e
MD5 af4e55df99e6ec085ff1fea53f182b95
SHA1 b2c1a78b5dd6864baa11b215e3ed714b89e20f58
SHA512 6cf7a3728ce6284e50b77da931ac36e814189543baf883cfba77f2cceeb5b7e7f12a28f51d716e040785af441974a5727db2ed174394eb14e66f21251457b18f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 c1a111719c4bc8d1b4ee8c1d2673fef1246d62fb5a7970b83db6a62db4675a12
MD5 d073ce20eaa4376a57228f250a487d0d
SHA1 22760f6f0f826d3db2c3e52dea2e6ccdb6bd671d
SHA512 c910a41b23bec27276c6a0f88d232a302961ddbb9b50229614e41fab600257536693ad9a94c77c4a95995a5161d9fb7b8377198e3514a4400e4569d15143a35d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a175b887b251ddcfd11cb85ac73d4fd9bcb3d7cb00a2c3a0106dc7a4675b70e8
MD5 b88550e7c8d79d59f2f25c3c39d09d7d
SHA1 5e362f253591afa64055c3bb2e36349d26c255fd
SHA512 f656c131a4222525146889c155d2fcdb863c44fad5c174ed913d53830ed74812a28de313750f0ddeaef7ff038c4bbcbb34a425415ddf3a0f2dfdddfd6aaa1f8b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 4982523e35d7d9ef4c95fe0a78096978f79f8564e02e2ceed8a71a2bf6c9f2fa
MD5 fed0724d7dad1231c6750cfa40dacdb2
SHA1 6744206157f657d0ae4b0c42640c651538e18730
SHA512 08bb92b2e92662fecc39013d9fb77d533934503831654d6c649a674f34254f2124eca53546fb38c66f71412681a2ecc7bf0657b7cdad7f965cd5ac11c082afd0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 38c393dce5928cec3f454f7c2af86c780b866c36549142385205f46a72204602
MD5 d886ef66c27d0c7613272b5046766270
SHA1 d46145c195dc6e659e3e204744872c8105f264f6
SHA512 f6101de55bfaa6c1f3a23b798acde367f72e80758f8323410f6c7ed6c80800e13b4b9a31d91e003f7a200754baebe2f648f2a645a56396bbf62fee8cd7accd35
SSDEEP 192:fafBfoDVq8yE+yy+F7kEskiYkBeBotjEsXtScPS:fa1oDgyxnI/eitIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 176B
SHA256 9847af05e3907fc2731a39bfd63ffb7fc766623e585108a52bc31192daf64c60
MD5 c035f4b7c7d92a8f2b501fa242639335
SHA1 2b7531ad7b86a01cb9c06c6feb41741808018932
SHA512 fa599824ea724862a968c47f76317052e53db47bcf38b317d96f05a4db0f401151b23290f14a67ec2d0ce1f23e08dbe25a93422e9d611658223814743ea24bde
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 112B
SHA256 bc911ce28e5736014b3cfd7e60c2b838f3ff2d811e54db9f1fa5516a58a29ce0
MD5 b1b39bd4bb6dd0a317b8f465182b4191
SHA1 aca61d518fa654f7db5aae12d45a1c6136b372c9
SHA512 969cee70d15f57e2b0fc72deda2868bdaa5cb71ccec02e1dddb3f72448ce6e7b32b3317c19744a8809b1f16a7b1cfc4692ccdd0068a9b703dc3905aa67db0a92
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57824f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57824f.TMP
Size 119B
SHA256 305bb4a88a43b7f02c5fdfc4551e84b7c1d1dedb1e45bae7bf6711f911dae338
MD5 f60b7f68e3a00e0ae70f1b4dd3232e99
SHA1 954ddf96423e530a4558bf62786b9ffaac0be005
SHA512 99a0fed7c9236c3be2246aab076f07b8399a8eb4f4e400e51235e0f63079f6a92e5da16807012aad617983fc3002e3b9143d307ea47bf6186313cf6039e6807d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 619101d9de6d8d12f0df6497b4e0ef57ca1aa38639b77872118f2b549b9d6b8e
MD5 6356d1b7a780e28efeffc0077b837de4
SHA1 36a48628862157ac1060a101936a09c161214ce3
SHA512 77b5aee5283a5bad609f44f05249029e1049f5cec251a8b89ea8ca68be67039d14c2160015cf655ea1ea31d04523e142fff8cb7f58cbbcc7f643cc1bced6df1c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57d532.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d532.TMP
Size 48B
SHA256 caabb98be5f90ce51bf698c159d8cd9f78bbcfc4608e0222b2e70dbb5f185773
MD5 fcd255c869ef486d0779c5ec21fabacc
SHA1 ab5fdbf7ce2121016decb432a0e54bde948baf71
SHA512 0ba9419c3bb74b01339eab1d77b9a135ebc640e4613d399bd25b89eb2d78a8a0c3c2e7ec957733a00088d414174cfe99aa99f15c8d516b5eee1950d2e9104c90
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\1\512.png
Size 10KB
SHA256 1d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f
MD5 7f57c509f12aaae2c269646db7fde6e8
SHA1 969d8c0e3d9140f843f36ccf2974b112ad7afc07
SHA512 3503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18
SSDEEP 192:CLLLRuqiztNFVh7D6ov5Zos7amFoMkFVwJOYSAxxqm3wk6E:CvLcbBNFvRh17amFvSwJCAxQmAkn
MD5 SHA1 SHA512 SSDEEP

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1428_767931917\Shortcuts Menu Icons\Monochrome\0\512.png
Size 2KB
SHA256 e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37
MD5 12a429f9782bcff446dc1089b68d44ee
SHA1 e41e5a1a4f2950a7f2da8be77ca26a66da7093b9
SHA512 1da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 229KB
SHA256 f07a50b0fb0cfd844542d21ec0e97673e13fd8df862b6e1d4edfcf7886fc0851
MD5 9691c7ffc72c240e2fc6f5952823dc90
SHA1 0f2617e7c309b495a918c6da6082539a59bacbbd
SHA512 092ae7fc44352ab3c580cd87b8824370e48bad2966e1774170cca82adc2a92335a128dee372d3109862ef1f966173b1d6ddaa4bc2688e6af1ea05fb47f4b3b38
SSDEEP 6144:ojSXDhU0ZEpC6BNC1bg1TB+70xBmboJnf9/ToP:zzhxAC6Bt1nxBOinf9ba
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 e4808f7ba60fdc78be9b020e496c21c005925c895c287e4891d7290e42b4d212
MD5 4c951fc0a52e30ff4acf2644ed43b8b1
SHA1 15b5da7e896d3f1d275161da2bfaf1213a22d863
SHA512 ff65a5cc456d9deae65cf8665fe4279015539d234325609816e93141dc2c0ce3a954cc80a1a7c0953663c7278daf869d7f3fb8e5a7386c0f04f1c0a49346b35d
SSDEEP 3072:C/jl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MC+:C/B+70xBmboJnf9/ToE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 1KB
SHA256 123c0449d980ca8b586aa23c7f022cb7649a9d37c3780ca9ff1da794bf823b53
MD5 b888406c09409582af8ad4d0ca797aa7
SHA1 ed47d6f999f841517da7d1e57980118d9f3e0e75
SHA512 1c927cef6b0fa7c159d609fdec425a1bd2ba64671dad87a510ba4cf4b20dadf6c0215b680665825e91e240d5bfb9c1c144250e792c1229bf4eaaca06a9700a4d
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 0c228c7798b064a15305c54e050aa5c7353d2de5d4158218c03ec270a386ab5a
MD5 3f1642b7a0240de15f867b71ddd7b06e
SHA1 fd3541470a8ab445264f91fbdc79b95b9f188634
SHA512 8485a1f81090597e06de1d9f1ef67077fceea3f84c697bd01c7c2656ee14dc0984b1ec3aa6b8fb383866bb1d207c08f7c22ee8fb300a7dc9f48eca33b7023417
SSDEEP 3072:CHjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MC+:CHB+70xBmboJnf9/ToE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 40395d9ca4b65d48deac792844a77d4f8051f1cef30df561dacfeeed3c3bae13
MD5 8549c255650427d618ef18b14dfd2b56
SHA1 8272585186777b344db3960df62b00f570d247f6
SHA512 e5bb8a0ad338372635c3629e306604e3dc5a5c26fb5547a3dd7e404e5261630612c07326e7ebf5b47abafade8e555965a1a59a1eecfc496dcdd5003048898a8c
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8dce1df4993505de28410317038a871653fdc84afe39e23e0209aba573c4dc92
MD5 adaec72374ea25fc32520580ed8ba4bf
SHA1 1dfcff26826847706b81cdacc3d24ca8948c6064
SHA512 aa391f6dc2d98bb6f00cd2bd3acfc35b72549452e2bace02d3e9891bf519ee277948627abf34b59f3df061eb1cb03495f5a0a89df49f7372304e46a4031b5dd8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5
MD5 f246cc2c0e84109806d24fcf52bd0672
SHA1 8725d2b2477efe4f66c60e0f2028bf79d8b88e4e
SHA512 dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 25KB
SHA256 3184bb6cec5264103e739a7a8c5d840abd607c89404a3da19d479ce0c05ddc8a
MD5 37938d074ffe143338b23827b2c9922a
SHA1 4a9324f636ace623bab2d19c9279714773e702d0
SHA512 272d2494b5fb19137988dd735b662a45f67fd782fac761af17215539ddccc814d93c6ece8590f6a8d0a2b8e95f9e554f9487ef7a51fabb45d0b01ba2c8fc9850
SSDEEP 768:WuejRWR4nwarqIIG4ZT4L8e+ccrY44emv/zW3JccMixJ:WuetWR4nVKG4AkzQeIa9MiD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
Size 33KB
SHA256 04d173d9ff132891d4c75ae62de7b095d7f098a68fe3e66ab50adc08a01709a1
MD5 34785fdfe8bc769c567dfb372c0ac49a
SHA1 7088f2ed86625a704b15b689fd4ee613ff626313
SHA512 1e3ff9e722571b49efa44af456e39847b70a6869cd0efd1534b7e9dce851a56b2afd0c1b31064e600cf852913e53b75c1be1b80de9d603eeb54670c41fa595b5
SSDEEP 768:sbIXFHn2OdKai3R4scIr9q7M3JrYPehsSOYzk4ft0lib:eSFjwfB7cIAeJKehsS3w4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 55KB
SHA256 787a3fd2c15be8e8fb7bf1f93b0b77e54c55fc8912c3533e7459a9cd37f9e296
MD5 4be8807eeb3515892fed1b14e0255706
SHA1 da2d36d1b72da52438787efc66a6eb23bedfcc96
SHA512 301cb6c64aa87f976d1433b813d53f345b5a69053f921dd71d5d00625e73b0a2a1e893e0720ef2afb0e3fbbb47cde822bde49873d9d9386f3e0899ae68ee60f6
SSDEEP 1536:WG9skFvB9k3H/UFQvbJ9mTqHE4Ti8+Ux/PWVB:HikB+3HsFsmGE4e8G
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 20KB
SHA256 d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb
MD5 c1164ab65ff7e42adb16975e59216b06
SHA1 ac7204effb50d0b350b1e362778460515f113ecc
SHA512 1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509
SSDEEP 384:KYo+7sitixxLBqKOxKsD1BPe8zZXUMxqSoDeZ54AR7eH7oaNNa6n:KYoysitiHLBq8WTtXnz9K47iNb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Size 16KB
SHA256 4e57f4cf302186300f95c74144cbca9eb756c0a8313ebf32f8aba5c279dd059c
MD5 9978db669e49523b7adb3af80d561b1b
SHA1 7eb15d01e2afd057188741fad9ea1719bccc01ea
SHA512 04b216bd907c70ee2b96e513f7de56481388b577e6ccd67145a48178a605581fab715096cfb75d1bb336e6ad0060701d2a3680e9f38fe31e1573d5965f1e380a
SSDEEP 384:m60n76CIHRODbU9VBUaiXB+F8NRYwiINmLGL0luobcIOgHMHFvUFG:90nkmg9XUTBU8iLIZ0luobcIOgH+MG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Size 34KB
SHA256 ea3a8425dcf06dbc9c9be0ccd2eb6381507dd5ac45e2a685b3a9b1b5d289d085
MD5 b63bcace3731e74f6c45002db72b2683
SHA1 99898168473775a18170adad4d313082da090976
SHA512 d62d4dddb7ec61ef82d84f93f6303001ba78d16fd727090c9d8326a86ab270f926b338c8164c2721569485663da88b850c3a6452ccb8b3650c6fa5ce1ce0f140
SSDEEP 768:tVmSx/bOqvDd2XiIkTFS8P5YsZIpKE09wpzdnyu4CmxsdRhNUA8tq7:twStOw2SIN8YsGpuOpzmIhmHq7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 49KB
SHA256 dada70d2614b10f6666b149d2864fdcf8f944bf748dcf79b2fe6dad73e4ef7b6
MD5 55abcc758ea44e30cc6bf29a8e961169
SHA1 3b3717aeebb58d07f553c1813635eadb11fda264
SHA512 12e2405f5412c427bee4edd9543f4ea40502eaace30b24fe1ae629895b787ea5a959903a2e32abe341cd8136033a61b802b57fe862efba5f5a1b167176dd2454
SSDEEP 768:WuI84bAhSakFKzyQWwqwZP+46j4DKQn5YuFSTdMq5Bgh5RbLmPnfB:2DvE9nZP+HjQK2yuEWq5Wh5NmPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Size 46KB
SHA256 bb77e10b27807cbec9a9f7a4aeefaa41d66a4360ed33e55450aaf7a47f0da4b4
MD5 beafc7738da2d4d503d2b7bdb5b5ee9b
SHA1 a4fd5eb4624236bc1a482d1b2e25b0f65e1cc0e0
SHA512 a0b7cf6df6e8cc2b11e05099253c07042ac474638cc9e7fb0a6816e70f43e400e356d41bde995dce7ff11da65f75e7dc7a7f8593c6b031a0aa17b7181f51312f
SSDEEP 768:wBeHNyL6MdIqdOnJzH2K5Qc3v2IJVSFTj9c443vMv3SgqwS4RxkmKHsn0S/q86UK:w7LhdynJzH2Kp3v2wVSFTxc44i3SzwSX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Size 46KB
SHA256 b6c5da3bf2ae9801a3c1c61328d54f9d3889dcea4049851b4ed4a2ff9ba16800
MD5 621714e5257f6d356c5926b13b8c2018
SHA1 95fbe9dcf1ae01e969d3178e2efd6df377f5f455
SHA512 b39ea7c8b6bb14a5a86d121c9afc4e2fc1b46a8f8c8a8ddacfa53996c0c94f39d436479d923bf3da45f04431d93d8b0908c50d586181326f68e7675c530218ed
SSDEEP 768:HTsawO0zGMoKDhy4NNlHM2Uq0QC2buj/nHub5DlJK/8VK5IIbqGtXpw07vds:YU0iMJVhNNZM/GOP8Ho/8Q6IbPtpC
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 37KB
SHA256 118d6f295fd05bc547835ba1c4360250e97677c0419c03928fd611f4f3e3104b
MD5 01ef159c14690afd71c42942a75d5b2d
SHA1 a38b58196f3e8c111065deb17420a06b8ff8e70f
SHA512 12292194bb089f50bb73507d4324ea691cc853a6e7b8d637c231fadb4f465246b97fd3684162467989b1c3c46eabb3595adb0350c6cf41921213620d0cff455b
SSDEEP 768:IvjwwmdktiQ3hQVQ7Uba5Uzaq1nOqaoYCoCXOYtQSuZgNgzPI0FYwvbnsXQE+rr:IvkhktiQ3hQVA5a1OqjXoCXFQS+wF2LJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Size 31KB
SHA256 b222b23c6ee94816389506d4de8ead66181c8053242e1e1eb784ccac46bc7ee5
MD5 81ac05c6d01d84d913a56c11909cdc7d
SHA1 55f6bd5429c5a35ed53caae2cd50d856edcb7883
SHA512 0925243828f33130cb3b68a6a113f1aabd07a8b19b3b99f45e5a2b1b2473622fa997d833c1d4b7b71781f246154d3a145aea37cda5351dc851eb3f4e550677ae
SSDEEP 768:sWzfeCBJsfRau5EAgzQRLYxSjbminAOvb5oAqLR43U8u:sW6CB8RXraSj5nBqAqLgUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Size 46KB
SHA256 529cafbd17efc15b436a7c3672fcb4abbe8c2b6001b7e674fe637fe78e19da3f
MD5 4d863110ed10189cad38ad28f7ec61c4
SHA1 9362bbb9d36dda4fe654240650a85a8b7edcc2ef
SHA512 abb09f12ff70e5899590229a99f1b9876f5f1c6f46c64026320a20c1bb4152a7e30c45e6ce23ef56ad304a74cd032e4be9302d1f609370f8bb72b1897b3e034c
SSDEEP 768:ooCPOr+0fP63BIp/venH/26rEPOdOYEUYBcoMBwxIRynsylW0/F5wuD6uLjmOCje:VCP8+T3G/vQf28zABUYtxlWSQUiXhZLm
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Size 769KB
SHA256 55de8a4ef942ffdf549b488849aa97cb4b1ba090d83bae5a37c4e29efb37821d
MD5 0a1589360e9613d646c623e8aecee16f
SHA1 7906609a5a3ff9c0c7bd3853e1bfd76f293c209d
SHA512 96946d949e33242126636c179ed4b0125eeab19077b104de0c8926e4b9330d1b2fabede77adab6ecfaa8b9e6145b64004ac53f6d7fc897ffc7483435d25f2b6a
SSDEEP 24576:DhGORCKDw0F+n1wAJYGSWzGGzyYxPj1uUa:4QDw0Y1nIWzDzyYhQUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Size 31KB
SHA256 d2d947e42ae142c387687536650a73ac99478051b80767761cf9bc8a595c733b
MD5 d77c023b2fa5275ae0489564e906abf0
SHA1 c48e7ad7f04b4476b7daeef6abbc85c7c55c97c0
SHA512 869a768742790b3bf6d6431539d0d60dc36157cfec7f3fca40ef3fddc7e2c15fb5687e396e1b321ef64cf658b79665f557d31effb7b116c1a2576c86129d1e8f
SSDEEP 768:tDdNMrZNLGPUolUHxoNts7cXrDInRGBRTT0qKlzxKT0:tJyFwaxo8c4RG7UqKJx00
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Size 32KB
SHA256 1bc3662afe002c4fa89c668287d8d28159dbb3f7740aff2bb44c6f91d04fa038
MD5 8a6a442cfd8c1a3d736b684e65c1097c
SHA1 c0458c7e5212d186aa1f3a88976f9ca4d1563730
SHA512 155606e650c386b8073cd511503001845d3b710ec9fe3c76c070063957b93285008c9b17c819c5d0eae9c040e725e7494ddac6fac3325cebc89b320cb0e13608
SSDEEP 768:kJmX1e9vj4ooE3If5Mr+4sXhuyCqxcEEQ+8H6T/jR8g:k8X1elPYhM2XhuyfOvTrT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
Size 19KB
SHA256 4da18811ecd0327a3373f6f6bd769df8007cdf81f1f42976a4f7ba6c31de750a
MD5 aaa549632a8ff62b66c1ad4a3ffc3c44
SHA1 c7ae8ec31a4cd8d3af6104151124b041c1bd386a
SHA512 11a7b3cd97010865b44b3182953ec4c89dbc91132632bb205587b29a14fdaaecda4d99f6bb850d4bf2bf0fb1da1876030e3934be6bad150fc6c173bafefd7cea
SSDEEP 384:KohW0rDKOxS3/UFDr1MvfHDUTlqm0jXfW4AbVaGtwQ/PBfZHR6Vv:KAW0rGOxI/2DKvPDmG2jtwGBfP6J
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f6b6cfc46254800736f3d7f70801978fe1335b3869e50b906b336babc319ec03
MD5 f4a67acfd48cb2d13f88c5062e1db844
SHA1 c341afb44ec224ba791f01e78a40d530ab3160d1
SHA512 a53df3295e99efdaf3c80eb304dece16c5d2770bd7baf6b346d2783ee4c1b9a6a739b56fed36bdccbfe44f7b880db837d7f2edc206e78f2d61faa37c0848a69c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 4b36c0e7d4df746c891890b997d82d36915701f966a82f670b87379c625ec495
MD5 b9f1b44ba349dbab56b61fab33eacb90
SHA1 482b2ce13baf4f9551279d3610980819aac2e3ad
SHA512 4c79500a8878a8bbf981d5400eba0ff1b9e99544307eacee0f60a28c50ab8e85bd845e8c3dabe01dae7f287db2b4625a9a08c02689aa6ab2a3bba8687bb23137
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a48b9c113462df24237a5f2cee091e6696964f062a78e6627acdb1bdde72b6de
MD5 818d7c6233e723a177efa0797eb1de5c
SHA1 b54a070e577509a11efbe6c3e72b6c8a6ffd7b3e
SHA512 3b06b66dc458a0434cec207287431c886c58027e9c38f1bdc3571be973d68e9d393495b2083be68ded11438e51c09c1f626cf4e859c74b0f9dbb9124b096feb1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 abad4aa94ec54fb3844cfaa0f779f1064a38c232000fa8ca2da0fd254cf5aacf
MD5 de81e719cd4069d41bdc307f53ffe7d4
SHA1 da0d306efc01adad831451ceaff63bce40af534e
SHA512 c21c84d7fed306950fdb603291a80d1dcde7044263211df8bbbbeb9e45e7d0fdc434ee25a727b955e59508fd9598d0965deb87ed2f6511114ff98220fe13948d
SSDEEP 96:ndkSE17tP4lGwpvWMoiVmdeH3RVUWQyV+VDCzia:ndkj/YGGWMXBVrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 85151ffb611af1d3671bf31a4bb4d233ea43ebb8bcae95f2e5bb8025c032d910
MD5 54101592c78b26a6179f09531bae74dc
SHA1 ff21eb6caa413a8b7989d039793ff4a3b029c6f5
SHA512 a76a4b7e961984aeb17f32d62b4b1b3087083324b7466ce1b22e9dec1cc93d899501321806ae37c6de2b69cb23e90ce5a3d88c3d7324e2063c55d68b3f51f93c
SSDEEP 96:nvkuE17tP4lGwpZZm9WMoiVmdeIYnMknYiMkMjYiMkwHffQFkMKUWQyV+VDCAiEc:nvkX/YGwY9WMYYnbYieYiMHffQTKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 69ca77d4f043b074bf8c67f46fb80b4aa9fab5f392ab364c52a7323a29d7d9a5
MD5 4a57d30d406b7b3f853aaf87fb7f87b0
SHA1 77b44cf7167ec2ca9dc6cf8eb01216ad8b7eae01
SHA512 c7c568ed228fc220782dbd247a43d72a29bf34c952868878f7d81e17bcd24d9b09564f0ed690bc6034b7d4ebbf958dbfc5bbcab425bddf6f0396cb1879e8477e
SSDEEP 96:nvkdE17tP4lGwpZZm9WMoiVmdeIYnMknYiMkMjYiMkwP9ffQFkMKUWQyV+VDCAih:nvkK/YGwY9WMYYnbYieYiM9ffQTKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488
MD5 5e62a6848f50c5ca5f19380c1ea38156
SHA1 1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a
SHA512 ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54
SSDEEP 768:nhCWu28F1+UoAYDCx9Tuqh0VfUC9xbog/OVYLlsgrUSz+1:nhCWu2u1jalLaSq1
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ea98d9f1-2b5d-42e8-89ad-06413e1b56f5\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 89B
SHA256 bae22d6b495d094105c07d8a47ac23fa12c3aa25fe0d9fed7efd71d085626822
MD5 834075177dd28460e086905f8fd282d9
SHA1 a5166787454d2b61c357cf3e5935ee668981b985
SHA512 9db7a2a26a5e6884d43157d1f9fe6b54d2c7a0b5ae0bd919fc773a250e8cbe6d0040d4bb4230040d2971dbd71a76bf947ed2d85c0a63ccda89e58505e9858058
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 64bb6d13f4b17588fedc7823df88ebbe5f2ab0ba732b1637954e577094c5fd15
MD5 f0deb0623437dde6d9454aa48734ed10
SHA1 98851e04e05392dfb45f956da902d3085d781439
SHA512 32fce0277004008646c31674947326f12dedb917ad359375a35cf7e69d7c2c94cb5d16150023306736b8ac7b389702d600bbae1e128f02197d9d3ec544a9e50c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 146B
SHA256 6c499bc7691811b7675a696e594466a79f980e82952bce603d35ba6683df36bf
MD5 a5eb2bc94583c3737ddb0b7ccdb49f1f
SHA1 1687f21d654440fb911d029479a7dc115a9a637c
SHA512 76771dc65cd7a445bf2ca3306671d620d3cbde180d0e7eda42164774b26d8f14a6dfda816ef4c5716d61a9da104bba836af9ea0c6ca9c337f7b7c5f6a5b866e1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 82B
SHA256 5294ffff733e9228c372d8d5572e83ecf3c855be334942c73c0de56c4f6cc85f
MD5 2c47d56ce6a03ec85d2aa8468020ae6a
SHA1 ddb6b9923e6fcc929b4538f2e214af90c9fd63b4
SHA512 2f56e7f4ce5bd7af3e3e69bec433fa3ce3cac7c83028036ca1e925c6c81f5911ee38e3cb241e592c39fec0e9c8fb4b7fb738d80f8eb349148db9e043af49e02a
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 45f8bec7a5d9c4d75c10befaec50e5c43fa650f4cf9e8eb0e46df2e7b4161ff0
MD5 d7ab4728b2e099170faf53aa82cb2dfc
SHA1 d2996d85f94b416eedda9d5cd1cb9a9282c703f2
SHA512 952accb33dc7cea6b3e7f76c615aeae26ffe7642093df533c9cdf91d8899a3406bc950210b3356bae631e9c0c14ae7adea0c4135d43e39f6754d2e36f6597937
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57eca2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57eca2.TMP
Size 48B
SHA256 f28880438dbd7aa3d623446319e10fa71904e109e0cabb818f5dfcb14d8bc34d
MD5 0a1cfcab2b32a899726f9f18a45f173d
SHA1 6e7cb4d98804a57887de6c5b7e28af88baa6027e
SHA512 5bb9ad089e1b96264046ce1815c005dce3e48e1a68ada7d78fdd65c790783639468aab63b57d2e50038517b452be4e6109552dee94b98bd33a8049e839f67974
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3d85a3f14b8b4bf8bb96859b687da2a41b46d0868de4c5fd7b565108aef43210
MD5 fc6d7b3bbd238dcb7dcc84a324597d3b
SHA1 3ddb13a7360f5b5634d31465c14001278461b192
SHA512 05be069d0f5b4230681949fb5b58442b9e3ff2e48927572220e0768f23fe2d6c9fd4a81dd685f51d8997b50c22735c74c97555358a031567df8a297e9fff15c5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 489f0963e1ec73ef2690d0f9d85ba09786ff1054099194f005b63a324b82dc5d
MD5 8552a52dc8888e057184f5bf2ca6df78
SHA1 eb3ee39264e80d416b87d0668a3012d7eeb2f847
SHA512 6be0b1e9cb8b0b46d3a757464c37f66e268c72dc810fdd0e9981054e9ac87e72e8f6f2ea6ad8fffc173714c7e5045272c57c8f4c43f409f2ddbdceacfb85acde
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 a5d877bc9fc64937d7d098f0da8e99f254d01e37b88e2e2cd760ff90915c1231
MD5 614dda644bd602887c127949e214a1af
SHA1 e83bab8b168a06435afbfdce3f41c21d679b0a4c
SHA512 d5a4511408f06018985fe11ad0804e1312b433e62c2a83100b658122309d0a95b29436e410be588c3fa3c2f5c36acf85418fe6fb5b11bb3a46eebbc3c2cbe9e5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5799bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5799bf.TMP
Size 1KB
SHA256 c2d7db4167f051f7bd02948466db674edece47fb9f635a8eea8615959df08f33
MD5 1fc9113cda9bdd0a969daca273a477a9
SHA1 d349af5424f3b25c4c755fc1847c911b02645a53
SHA512 64e501093179db9a153d77c70063ad40193f5cde79a4e1dc3cdb6648944751631ec2b565e0fa88449ba0f9bcf4332858ef579f689f085bb69adacc512bc50f7e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 517f6818770751fa6b40df53c9d19e146f897a3b5ee389378335e15cd1d5d40c
MD5 a958cc9c105b9e2a4409b71d41c59867
SHA1 998a565eb17f57b998f2e3ddb20681f327db47fc
SHA512 a6da10dee12ba3c2e0cc4dc00e186354168753b93e6b2df84443ae58621a4822e8307baf43e15b638b9b4e49027e1d7d914e716c9505702e23cf7ae1bcabaeb1
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 485c1a99bda69e5c3240f01595c81323083ff8e09a4ec5c24551fcd3bc9b18f7
MD5 e73e41c456fc96ffabc3d2b8ae26602a
SHA1 dcb6556e5153e220330c7e8bae88412f5d065719
SHA512 19b8dafbda710adaf2961888d95a0e7843dbd6617d42af63787225c71900f5fd6886ef242c620500750f8086912beccf414c67958276844fa50cc170f78e4101
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9f38c9bf491e00e02b3e20898d0ae6a30b36fa70c5d494d815e8a65b1698d1ad
MD5 fcb104a1152864b88c928f5b45d73902
SHA1 da2e8182a9c24a6a3738c754eecc3f290335be50
SHA512 fee74652303a351f17d932530518533e3bcdb0055502ee643587ddd2ccc51e80b115c3fd90ceb2b56b913a2a91aa19b34726055fd9c08f3d9b331bc3a871799a
SSDEEP 192:eoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiie2RUL8SpneF1Hc:q9iIxuERzA83h09RZxYFypf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 6604e7addcddcdb3bb1c828328b371e120f956566333b186b318b5f0c3b1fad0
MD5 7e39f56a0bc905f35385b44134a2ca3d
SHA1 07db66aa6609d24a333141a59cb1536e220818e6
SHA512 ca82abc4543daa029c1d667d89e05bbf9e3be0b3ffc10c6bca03e1c1b380838900275572c973e1d65cde00e08b5ab58f069c173673bbac4edd743c99efa13f6c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 8e13b259fba92f5700ee7ef0a7780606fb54511b21bd2e4188576320d89d50c2
MD5 56b3533a7ae2e024e773c34e32e1e707
SHA1 a8f765cc409c73bf14d7cbe1901a45c50b6eed5e
SHA512 0b713d73f99398fda6d26c46c689875875dd2ee17b495e023143b64e07a572cb6bdf0f7afacc246493d1cdc7c941b224f9ffc83b01430e7e0781d1c38894a82c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 e5fa357fb6c30702775c420571025e07abaa4c8b0a9a0d591a40a9e76852dbbb
MD5 d065064527302d1d153ee06e21812290
SHA1 b80aae9dc64d9b303726ab4bdc4810d89ad9e2db
SHA512 01a249860dc871cf14f4f6f612d69c45afff6713166e8a961e1787efd0bf7af1b78725144a5e1189d8317c61adefea69aff01acee995271318ff07717efd132c
MD5 SHA1 SHA512

Submit Download

2AE697994331154B522799928B92AC499D2475AF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qmjs2eet.default-release\cache2\entries\2AE697994331154B522799928B92AC499D2475AF
Size 30KB
SHA256 afa579231e579b951b1b963499d3fdb8094dd984cedb570adc8db5d7652c0afb
MD5 3db73f8c1a88e7c913c55d01380509ce
SHA1 a1a65d39f5a9d1270cf798eb271c7292f3707384
SHA512 46c565bb635f9dda44050ceea7af61a374447fd94262c86b23cb73324a5c760ac4d15fe903424220d622350de6b79846025d79a095312fd9e43e0588459edb2a
SSDEEP 768:xjOHG87OcvMTfzgWt+omDKosTCebTCjhcG+8G+8W:1OmyOVEWtJmFQHG3
MD5 SHA1 SHA512 SSDEEP

Submit Download

2BB62A5F508187291BB477E79601AC81B652604E

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qmjs2eet.default-release\cache2\entries\2BB62A5F508187291BB477E79601AC81B652604E
Size 30KB
SHA256 b55baa0982ddf1d065b420906abec5ae17a077ca43cba703e6fc34ac053fbec7
MD5 e75d4d3eeaacc3261b55b21772f406c1
SHA1 a7639dfd27f24b01c20d37738ff6f9c4471ef8a1
SHA512 4c18acc1f458a212665cdb72c64957a00c43da8f97b939fe058b83a462bdde55b7c64626ce8cbb733884d6d73be60872bad17c3b97e512edd803c9cf7d7d7aaa
SSDEEP 768:5bfiBWlRPm5fjrruYJGTiqlO3fo/zzyUFpEudG79HWABHJmvORX:AWLivuYJGTiqSUfVwdrWORX
MD5 SHA1 SHA512 SSDEEP

Submit Download

83F05873F11EC50D7A0DBCF1ADA1A53449004CBB

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qmjs2eet.default-release\cache2\entries\83F05873F11EC50D7A0DBCF1ADA1A53449004CBB
Size 26KB
SHA256 8d5857fa964ff08499d0aa2aef0435e8c32d3218805c61f1f55f4d8ea20ee68f
MD5 f00686fbe33695cc2d2067acfae8b8c2
SHA1 e74e77354fb65fae75566cc3e4ecb69270124e7e
SHA512 40f60f274472c10ce69a57999e1a17bc8be55b2c20225ebecbc46d8d2b7bd4dbb976dcd44fa9e200e77a3d901bb17fc783b9d46b381de2835e56f834165c6936
SSDEEP 768:YXCgzSPqIEDn3eaTCebTCjhcPGl+8Ql+8p:WCcSCtbOaHGcG8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

DFF427F3036CB4FD84301A0F4A7459DEC961B2C3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qmjs2eet.default-release\cache2\entries\DFF427F3036CB4FD84301A0F4A7459DEC961B2C3
Size 32KB
SHA256 9c4a985d5eb9eec8feac4ec6a6dbd376e1a8d3465401615016e4b812c7705d28
MD5 ba325934e27d224e2e0d143e121673fb
SHA1 43501bc72203be399ab0bf057bcfa788eca1b020
SHA512 bce958aa835ac8b54a43978470003b180c048792da7722bb027b95172e7cf647493b59b16d6262af415e38044ee5065d78df92607d3ffa137192db50a8049b71
SSDEEP 768:GdTDA++sri6paRWijNmEts/ZNOy19TCebTCjhcxRD:GVDzfiaaRWNb/yWHGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

F96A1A8368D3C3DD1FA81D170326E6C1C65D342F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qmjs2eet.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F
Size 30KB
SHA256 f046f6b3611ec2645a5baa5e32fe8a5f8a6c91a5bace8e50017ab5283d1cfbfd
MD5 cf201a624afc2a0c76cf7b5ccd8373bb
SHA1 db66c386e067c69caf7177a034a78b2f61845975
SHA512 8ece9db75a90d0e33ca60045d1aa49f25a8f15c0af7b5fcf4b94213553eb159127a1871a1ebe42d1eefe612f2c74bb9505b2fde45ba758340c6c1ad47055095d
SSDEEP 768:UaxmXXSdiQPCjMvyugNiuzzyUFpEudG79HWABHJmvORn:U7nSdTCrVwdrWORn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 41KB
SHA256 67f129f865f6673b6dbd0d9ca0abb451c064e814237822241382051ba8bfeb1a
MD5 39c306c7da6e91ab9505cac34be5a82e
SHA1 8a930b8e70d54779c5ac29754145482ecc7de3a7
SHA512 8c0fd193da9f4f1de26a2e004ec5bc3e5dc2da62033d6c5211b5c5b6b835d1618339820d9b202b53d344821a9346a8603742896c28ce689452674a0ca46a1ea1
SSDEEP 768:PAuxOqmay/Wvzd0mauYsGafwtmvLVRdm0607Ds32k7TnZXxy8PzLkl7rbMniQDgN:PAuMqmay/o5aahTVRc0FQ2k3ZBy8/kF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 2.1MB
SHA256 174dbcfc19adf809beb4f24f38e3eb81d49aec66cac9986e27993a5fdaa5a4c8
MD5 3032be8dff9c58a627e6f15444792113
SHA1 c9b13be877221cc5282dcdc38e2b5f89e9f7c2fb
SHA512 e4951861231afbc1f0a42387a7df78cdd5d91100ad77369777b638bad0f94766eb5ac026f3322c36f82d9dca4b508bae224a7f1d4acf82ca6259e893d528b77e
SSDEEP 49152:wXQ1cJvEZR7+56mfLrZqNvniDpd1c/GA5pLPXiN6csCflASd/vy:H1U8Z456mfLrmvnit0n7G6cvflASpy
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 e2af6bae649d9ab6c23344a5d67c48e14151df6ed98efa3f3a86eb98156ce68d
MD5 528abe4f6c68dffa686532a4d3a640f2
SHA1 ad403c27299b5f3d228f7b512cf6664468cd1047
SHA512 2ef621051ea1f96544e5fd75b7039262ab23bf3dd10a0b86444ad3a61932deee80e93fc3441d6ff99d1bb04e3d1f6036a01e4e885ba7d1fe04a9cd490ddb404c
MD5 SHA1 SHA512

Submit Download

0d10c977-1c72-4b3f-afc3-95ca6c8a7e4c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\datareporting\glean\pending_pings\0d10c977-1c72-4b3f-afc3-95ca6c8a7e4c
Size 746B
SHA256 d6a4f0ce593d785f846eca178938fcfb4775f4c4c0cd6e489c4de7286c4a0b28
MD5 921c8ec0c3cd625c41f1bea6f8b7abb9
SHA1 506b987dab96a282a41b20e320a543e3567de070
SHA512 20377fcb0bd9f01bd8695f61551d70b4db61dae27968a9c4aad91c157e9f97a6606566bb1a878c5c6bc3b1f056d92a256de3f838461b6dd0960e821629c9dee7
MD5 SHA1 SHA512

Submit Download

5180e3d3-0755-4553-8672-143b411c77e9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\datareporting\glean\pending_pings\5180e3d3-0755-4553-8672-143b411c77e9
Size 10KB
SHA256 d47ffb0951fd0903f6af486c63668aae22d6367944496760f45bf0c053873478
MD5 f3a061fb7722191bba24c27e00fd2812
SHA1 7d121d5405fd6df2d188335d77d85b5131d44437
SHA512 3081d4262f5d2e6e5864584a181b130a676bb73c76f80de559cfd6ebf02cc6c3baa8f8be92cad59e50303f49ae4d980ccc065d89d72345cd17a1e42776434376
SSDEEP 192:9JlI9M65+GIqGgtVJNhXvMONGbKACO0D84tz35X6GJgdME16CapH:nW4Elkax
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 3.0MB
SHA256 f553fc5edd4951a281881b6ca9ad325432377b4c0bbc07bc042b76d9acedb323
MD5 cbb62dd2013dcff0acb71e51044da288
SHA1 bd212c3842c7a27e376b6b6602d268a7fedb2bc8
SHA512 308dd6b37c10bae9d4f81b386b62edfd8cf0ea5cfb7827abfaa161c6d8eb8179db1e7d9bf11c61b45da8d06c8e5d8c61d01e5059e53506b2f7d8e8daf93dde93
SSDEEP 49152:5Xs+8h2DPalVFeauwvez+Wgo5xRY/+Ca1CxPkAgMwBkzRifx0rkpa1TTpfNsIAkc:lP4WQvez+WLvb1CKAFw6Rq4yr
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\prefs-1.js
Size 6KB
SHA256 7e00ae47285061c72e6bf6534a47f20e7424a864e8c6094dbd670921a6b65cdc
MD5 b380622d863449be86ebb1b025608a3b
SHA1 ba084b95ad35199dbda4c858c6dac7598b265701
SHA512 ea984f90f7f25f47c34e7a994cfe6442a43cf0ffd22cb9b811285a4db9650f1bcb27f15a1b5a101477bab0e267e7e81408dfd137715baf753a32693f8feb130f
SSDEEP 96:xH45nUTeqGqMdKyNveOTzSr5PXAnpjGHUofoHBw8Hes:q5nIRMdKypeF5PXbVABw8HL
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\prefs-1.js
Size 7KB
SHA256 a6f62dbf6d3c82b3ba392d5fed98c7e6861ac605b8c6fa5358de874e851d5f1b
MD5 e07d7c7d9152500cc5119e72f13490e8
SHA1 3f14cbd6821d1c0d1d832cd7e59fa34baf18e190
SHA512 bf68650bb5009363dd2593cdaf40a324fcfea6253cd15f9cbe0f3925f0e4ba1a64452aef4bc9e408c28cc2dcc2a393e1c836b50d90a16d28020a59b287f49e77
SSDEEP 96:xHZGnUTeqGqMdKyNveOTzSr5PXAnpjGHUofoPBw8He2:nGnIRMdKypeF5PXbVwBw8HV
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\prefs.js
Size 6KB
SHA256 9ea1178d320592e8d0d4512fbb18703d3247b09bf95febbf6fcb813a1c47a161
MD5 f4b7721db7f48463dc938ff215b51e21
SHA1 c776057703d7289b3a933432c2a0401e8a106455
SHA512 0f920b39e0fbd5bd74b12bd9c22b0845cd937cdcb9c0d8962a43bb117595a003900435281e7cabf8e27d3cd05c4242c761c819e9278e9a81493f3c18500c076b
SSDEEP 96:xH45nUTeqGqMdKf6eOTzSVPXAnpjuKHUofodBw8Ves:q5nIRMdKf6eXPX+VWBw8VL
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\sessionstore-backups\recovery.jsonlz4
Size 7KB
SHA256 080fd77cf268e3f754c246ec335d2f67a6286f001c915530cdafd28b3d632404
MD5 3950544908432aa847fe6960f783f616
SHA1 3fdc7148f893b76e4383eb8ec0a437e64a1e34c5
SHA512 b3276530a3b38204e6e7288893094f6db3f78dbc8c89a33d66de570c278f3e28e53fcd2763ac17533716d6007369e0c7384b7b1444accf1af7a0a29e518e0709
SSDEEP 192:MOtl9reCgOFEk7vvm/pQFkkxi83Y20LlMZk53VJ5BKpyFo3:MOft7Kk7vvmxQFkkk83mhltKp33
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\sessionstore-backups\recovery.jsonlz4
Size 989B
SHA256 75340a0454edea652e90e1fac2c853c9573f58e24ee86ab813fcc602d284df0f
MD5 df7a73b93ea05cfdd7e5abaf773bd7f3
SHA1 344a86d5995e83863b10c610752136064873aed4
SHA512 103811b3a9f8c1915a9de7e2e7aff0478bd407a562d741ed4bb8356747964a8a8088dac4191e53904229a8c666662e035436c5514f79cd89e67ddde6f7238e9f
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 24c82c9a1ed44a6a2302c4f4bb785514d784119ea6ad846c041de1b12de1944a
MD5 9d3ae693c5705417954d29dff633e870
SHA1 087c0881babcf994ff10de56bec9706cb9efd108
SHA512 f98d9df4424ed14799b8afd4b9c65e1a43a4ab9cdfe56fc9356a6e3cf8c609bd80edeaaff3e2fac99192fc404d8576a2756f710e35c0d52a5f34690b704d7eb3
SSDEEP 3072:KMcHDPRuFP+3y3gE396O6uacMKeHex7Nq:KMcHDPR023y3ga6uacMKeHCq
MD5 SHA1 SHA512 SSDEEP

Submit Download