092ed857df8ec913684ac83fd7c334ae39ebf364abb3537c76e1124429b7970b

Analysis

max time kernel
2088s
max time network
2171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Topaz Gigapixel AI 7.1.0 (x64) [FileCR].zip
Size

704.3MB
MD5

7bf545ed35374b1f0f78e8e5dadec4c0
SHA1

5c5d7d4ab6315319f5e9ce45e2b3fdd7d29ec862
SHA256

092ed857df8ec913684ac83fd7c334ae39ebf364abb3537c76e1124429b7970b
SHA512

a5c63905969dd01e43b50045a55fbeda75eec47193f84a7c2d1d07ccb348246713cc84c5eda405cbda23dc21a8f318862f493561430e6a6630325530f3153e77
SSDEEP

12582912:oY8HKZTNWFYIYSqUgWI+jkTnF3TQksukBjtBtYFxWYwAYYFATzzIPeabeoly3iub:zhZNtxWl+nsJVYFxWt92uMPeayHiuNiy

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7zFM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Patch.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Patch.exe

Executes dropped EXE 6 IoCs

pid	Process
6016	winrar-x64-700.exe
3116	winrar-x64-700.exe
5772	7z2301-x64.exe
1128	7zFM.exe
1296	Patch.exe
1996	Patch.exe

Loads dropped DLL 15 IoCs

pid	Process
1128	7zFM.exe
3136	MsiExec.exe
3136	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
3292	MsiExec.exe
3292	MsiExec.exe
3292	MsiExec.exe
5144	MsiExec.exe
3292	MsiExec.exe
1432	MsiExec.exe
1432	MsiExec.exe
1432	MsiExec.exe
1296	Patch.exe
1996	Patch.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
218	5024	msiexec.exe
230	1432	MsiExec.exe
231	1432	MsiExec.exe
233	1432	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\27683AD081FD157DACCE8B97E9C1AB4E	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\27683AD081FD157DACCE8B97E9C1AB4E	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Material\Pane.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\com.topazlabs.TopazGigapixelAI\manifest.xml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Basic\Slider.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qmltooling\qmldbg_profiler.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Imagine\SelectionRectangle.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\Qt6QuickDialogs2.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\lensfun\db\slr-samyang.xml	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Material\Frame.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Material\impl\CursorDelegate.qml	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Universal\CheckDelegate.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\TModelManager\qmldir	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\npu_driver_compiler_adapter.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\NativeStyle\controls\DefaultTextField.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Dialogs\quickimpl\qml\MessageDialog.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Basic\WeekNumberColumn.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Universal\ScrollIndicator.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQml\Base\qmldir	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\lensfun\db\slr-hasselblad.xml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\TNetwork\networkplugin.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\ScrollView.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Basic\TextField.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Basic\impl\qtquickcontrols2basicstyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\TextArea.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Imagine\ScrollView.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Dialogs\quickimpl\qml\+Imagine\FileDialogDelegate.qml	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Imagine\Dialog.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQml\Models\qmldir	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\RoundButton.qml	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Imagine\GroupBox.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Dialogs\quickimpl\qml\+Imagine\FileDialog.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Material\MenuBar.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\lensfun\db\contax.xml	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Imagine\Drawer.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\ScrollBar.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Basic\Drawer.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\lensfun\db\slr-schneider.xml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\TImageUtils\imageutilsplugin.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Universal\GroupBox.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Universal\impl\qtquickcontrols2universalstyleimplplugin.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2301-x64.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\lensfun\db\slr-sigma.xml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Basic\ToolBar.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Shapes\qmldir	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\translations\qt_gd.qm	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\BusyIndicator.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Dialogs\quickimpl\qml\PickerHandle.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Window\quickwindowplugin.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Basic\AbstractButton.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Material\DialogButtonBox.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\Qt6Svg.dll	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\lensfun\db\mil-canon.xml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\impl\SliderHandle.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Material\TabBar.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\qmldir	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\CheckBox.qml	msiexec.exe
File created	C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\qml\QtQuick\Controls\Fusion\RadioButton.qml	msiexec.exe

Drops file in Windows directory 39 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{12A23EC2-5BA1-43CA-8FFB-44CBE22575AA}\Topaz_Gigapixel_AI.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67AA.tmp	msiexec.exe
File created	C:\Windows\Installer\DerandomizedSymbolicLinksForSourceLists\TopazGigapixelAI-7.1.0.msi	MsiExec.exe
File opened for modification	C:\Windows\Installer\e6380af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\e6380b1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6FB.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI776B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF082.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9CE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EE.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{12A23EC2-5BA1-43CA-8FFB-44CBE22575AA}\Topaz_Gigapixel_AI.exe	msiexec.exe
File created	C:\Windows\Installer\e6380af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\SourceHash{12A23EC2-5BA1-43CA-8FFB-44CBE22575AA}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\2CE32A211AB5AC34F8BF44BC2E5257AA\7.1.0\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI769F.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064efbbd21686319b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000064efbbd20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090064efbbd2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d64efbbd2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000064efbbd200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MsiExec.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CE32A211AB5AC34F8BF44BC2E5257AA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\Net\1 = "C:\\Windows\\Installer\\DerandomizedSymbolicLinksForSourceLists\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\7zO864894D1\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7zO864894D1\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\48D7981F38EB64F428F500C75DD82681\2CE32A211AB5AC34F8BF44BC2E5257AA	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\Media\DiskPrompt = "Topaz Gigapixel AI Installer Package"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CE32A211AB5AC34F8BF44BC2E5257AA\VCRedist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\ProductIcon = "C:\\Windows\\Installer\\{12A23EC2-5BA1-43CA-8FFB-44CBE22575AA}\\Topaz_Gigapixel_AI.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2CE32A211AB5AC34F8BF44BC2E5257AA\Complete	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\Version = "117506048"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\PackageCode = "B68B7E8818D144B49BC64F46A45F4C85"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\48D7981F38EB64F428F500C75DD82681	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\PackageName = "TopazGigapixelAI-7.1.0.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7zO864894D1\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\ProductName = "Topaz Gigapixel AI"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2CE32A211AB5AC34F8BF44BC2E5257AA\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7zO864894D1\\"	msiexec.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\winrar-x64-700.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2301-x64.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5824	NOTEPAD.EXE

Runs .reg file with regedit 2 IoCs

pid	Process
4528	regedit.exe
2336	regedit.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
1128	7zFM.exe
1128	7zFM.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
3524	msiexec.exe
3524	msiexec.exe
5144	MsiExec.exe
5144	MsiExec.exe
5144	MsiExec.exe
5144	MsiExec.exe
5144	MsiExec.exe
5144	MsiExec.exe
5144	MsiExec.exe
5144	MsiExec.exe
1128	7zFM.exe
1128	7zFM.exe
1128	7zFM.exe
1128	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1128	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	4356	firefox.exe
Token: SeDebugPrivilege	5272	taskmgr.exe
Token: SeSystemProfilePrivilege	5272	taskmgr.exe
Token: SeCreateGlobalPrivilege	5272	taskmgr.exe
Token: 33	5272	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5272	taskmgr.exe
Token: SeDebugPrivilege	5464	firefox.exe
Token: SeDebugPrivilege	5464	firefox.exe
Token: SeDebugPrivilege	5772	7z2301-x64.exe
Token: SeDebugPrivilege	5772	7z2301-x64.exe
Token: SeDebugPrivilege	5772	7z2301-x64.exe
Token: SeDebugPrivilege	5772	7z2301-x64.exe
Token: SeDebugPrivilege	5772	7z2301-x64.exe
Token: SeRestorePrivilege	1128	7zFM.exe
Token: 35	1128	7zFM.exe
Token: SeSecurityPrivilege	1128	7zFM.exe
Token: SeShutdownPrivilege	5024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5024	msiexec.exe
Token: SeSecurityPrivilege	1128	7zFM.exe
Token: SeSecurityPrivilege	3524	msiexec.exe
Token: SeCreateTokenPrivilege	5024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5024	msiexec.exe
Token: SeLockMemoryPrivilege	5024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5024	msiexec.exe
Token: SeMachineAccountPrivilege	5024	msiexec.exe
Token: SeTcbPrivilege	5024	msiexec.exe
Token: SeSecurityPrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeLoadDriverPrivilege	5024	msiexec.exe
Token: SeSystemProfilePrivilege	5024	msiexec.exe
Token: SeSystemtimePrivilege	5024	msiexec.exe
Token: SeProfSingleProcessPrivilege	5024	msiexec.exe
Token: SeIncBasePriorityPrivilege	5024	msiexec.exe
Token: SeCreatePagefilePrivilege	5024	msiexec.exe
Token: SeCreatePermanentPrivilege	5024	msiexec.exe
Token: SeBackupPrivilege	5024	msiexec.exe
Token: SeRestorePrivilege	5024	msiexec.exe
Token: SeShutdownPrivilege	5024	msiexec.exe
Token: SeDebugPrivilege	5024	msiexec.exe
Token: SeAuditPrivilege	5024	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5024	msiexec.exe
Token: SeChangeNotifyPrivilege	5024	msiexec.exe
Token: SeRemoteShutdownPrivilege	5024	msiexec.exe
Token: SeUndockPrivilege	5024	msiexec.exe
Token: SeSyncAgentPrivilege	5024	msiexec.exe
Token: SeEnableDelegationPrivilege	5024	msiexec.exe
Token: SeManageVolumePrivilege	5024	msiexec.exe
Token: SeImpersonatePrivilege	5024	msiexec.exe
Token: SeCreateGlobalPrivilege	5024	msiexec.exe
Token: SeCreateTokenPrivilege	5024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5024	msiexec.exe
Token: SeLockMemoryPrivilege	5024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5024	msiexec.exe
Token: SeMachineAccountPrivilege	5024	msiexec.exe
Token: SeTcbPrivilege	5024	msiexec.exe
Token: SeSecurityPrivilege	5024	msiexec.exe
Token: SeTakeOwnershipPrivilege	5024	msiexec.exe
Token: SeLoadDriverPrivilege	5024	msiexec.exe
Token: SeSystemProfilePrivilege	5024	msiexec.exe
Token: SeSystemtimePrivilege	5024	msiexec.exe
Token: SeProfSingleProcessPrivilege	5024	msiexec.exe
Token: SeIncBasePriorityPrivilege	5024	msiexec.exe
Token: SeCreatePagefilePrivilege	5024	msiexec.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5464	firefox.exe
5464	firefox.exe
5464	firefox.exe
5464	firefox.exe
1128	7zFM.exe
1128	7zFM.exe
5024	msiexec.exe
1128	7zFM.exe
1128	7zFM.exe
1128	7zFM.exe
1128	7zFM.exe
1128	7zFM.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5272	taskmgr.exe
5464	firefox.exe
5464	firefox.exe
5464	firefox.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
4356	firefox.exe
6016	winrar-x64-700.exe
6016	winrar-x64-700.exe
6016	winrar-x64-700.exe
3116	winrar-x64-700.exe
3116	winrar-x64-700.exe
3116	winrar-x64-700.exe
5464	firefox.exe
5464	firefox.exe
5464	firefox.exe
5464	firefox.exe
5772	7z2301-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 464	3628	cmd.exe	106
PID 3628 wrote to memory of 464	3628	cmd.exe	106
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4076 wrote to memory of 4356	4076	firefox.exe	112
PID 4356 wrote to memory of 3956	4356	firefox.exe	113
PID 4356 wrote to memory of 3956	4356	firefox.exe	113
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 1220	4356	firefox.exe	114
PID 4356 wrote to memory of 3588	4356	firefox.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Topaz Gigapixel AI 7.1.0 (x64) [FileCR].zip"
1⤵
PID:724

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\explorer.exe
  explorer
  2⤵
  - Modifies registry class
  PID:464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2832

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.0.1818760515\349911092" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3922ffc7-c495-4d1e-a37d-1bdbcad45414} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 1948 1cc435d7f58 gpu
    3⤵
    PID:3956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.1.1834518300\1950430283" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0455d93-8aed-4ad7-bbd6-965cf855d6c8} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 2348 1cc2f772b58 socket
    3⤵
    - Checks processor information in registry
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.2.527206996\6774217" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3092 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6db11e2-5e39-4ca2-8fe8-4e82d6289422} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 3108 1cc4355fa58 tab
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.3.1476087451\127517578" -childID 2 -isForBrowser -prefsHandle 3444 -prefMapHandle 3440 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {623d02f1-8e56-40b3-bb29-30e68566b481} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 1396 1cc2f771058 tab
    3⤵
    PID:416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.4.254475463\1508746337" -childID 3 -isForBrowser -prefsHandle 3796 -prefMapHandle 3792 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2008075f-7a7d-4772-af62-fe7336d3563e} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 3804 1cc2f76e558 tab
    3⤵
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.5.1337843885\1939342465" -childID 4 -isForBrowser -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4443d7af-f9f5-49d3-9c04-76944116ffca} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 4952 1cc475bc158 tab
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.6.1478360451\644733671" -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 4056 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d8575d8-b7f1-48c4-9f10-67a9d26c8ac6} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 5144 1cc499dd258 tab
    3⤵
    PID:3396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.7.114364491\797228033" -childID 6 -isForBrowser -prefsHandle 5300 -prefMapHandle 5296 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1746a08-89e6-4f10-b054-35d68546ec4e} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 5284 1cc49a38558 tab
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.8.911943643\261005298" -childID 7 -isForBrowser -prefsHandle 5864 -prefMapHandle 5860 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {360aae09-c07a-461c-a73a-91292c633f13} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 5836 1cc4bfa0558 tab
    3⤵
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4356.9.210953810\680633283" -childID 8 -isForBrowser -prefsHandle 5468 -prefMapHandle 5308 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1400 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b00d509f-5af3-45b3-baa0-81fc5a2fa2b7} 4356 "\\.\pipe\gecko-crash-server-pipe.4356" 5316 1cc2f72d258 tab
    3⤵
    PID:6044
- - C:\Users\Admin\Downloads\winrar-x64-700.exe
    "C:\Users\Admin\Downloads\winrar-x64-700.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6016

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\be1f2cc3192d462cb48baf7505075bad /t 6020 /p 6016
1⤵
PID:5640

C:\Users\Admin\Downloads\winrar-x64-700.exe
"C:\Users\Admin\Downloads\winrar-x64-700.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3116

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4824

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\b503f7eb31574337bdad03b9b4b4f3c1 /t 4416 /p 3116
1⤵
PID:1792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6124
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.0.880924141\629859522" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 21553 -prefMapSize 233776 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2de36947-2078-44db-8559-1659db5a187e} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 1980 16e202d7e58 gpu
    3⤵
    PID:5560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.1.774909595\1499126247" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 21589 -prefMapSize 233776 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9c94b94-4a66-48bd-8e02-fd70584f0bee} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 2380 16e201fd958 socket
    3⤵
    - Checks processor information in registry
    PID:916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.2.534057604\1099357119" -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 3168 -prefsLen 21692 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcbabc5e-e281-414c-9a74-41060f0eadfe} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 3184 16e244a7458 tab
    3⤵
    PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.3.2001317142\1927753257" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26870 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5b7ecdb-c22c-42d3-ba04-5552228ea297} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 3612 16e2499d858 tab
    3⤵
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.4.476853260\90261369" -childID 3 -isForBrowser -prefsHandle 4260 -prefMapHandle 4268 -prefsLen 26929 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28bd5465-5bf1-46fa-bb48-22c0e7e42784} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 4276 16e257d1f58 tab
    3⤵
    PID:8
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.5.968226727\1684456947" -childID 4 -isForBrowser -prefsHandle 4500 -prefMapHandle 5136 -prefsLen 27008 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f04f7d8-2a73-4aca-830d-5b1de357334e} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5132 16e0c767e58 tab
    3⤵
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.6.425044626\8201704" -childID 5 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 27008 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d33671be-7024-4b8f-b4be-767433c3257a} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5348 16e2444ae58 tab
    3⤵
    PID:4748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.7.1799396840\1787134495" -childID 6 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 27008 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7835ce9-a1df-4000-a082-8e98bdbd3f79} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5536 16e2782a458 tab
    3⤵
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.8.288129466\1010387709" -childID 7 -isForBrowser -prefsHandle 5472 -prefMapHandle 5376 -prefsLen 27008 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {015f3856-6c09-40c0-88b6-d2191105403d} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5824 16e28bdb958 tab
    3⤵
    PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.9.13385263\1483327705" -childID 8 -isForBrowser -prefsHandle 4896 -prefMapHandle 3936 -prefsLen 27008 -prefMapSize 233776 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d68aff64-d20f-4160-be0d-35d1173354ca} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5208 16e0c767e58 tab
    3⤵
    PID:5456
- - C:\Users\Admin\Downloads\7z2301-x64.exe
    "C:\Users\Admin\Downloads\7z2301-x64.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5772

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Topaz Gigapixel AI 7.1.0 (x64) [FileCR].zip"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1128
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7zO864894D1\TopazGigapixelAI-7.1.0.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5024
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO864D0291\Readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5824
- C:\Users\Admin\AppData\Local\Temp\7zO864821C8\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO864821C8\Patch.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1296
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\\regpatch.reg"
    3⤵
    - Runs .reg file with regedit
    PID:4528
- C:\Users\Admin\AppData\Local\Temp\7zO8647F1B8\Patch.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8647F1B8\Patch.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1996
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\\regpatch.reg"
    3⤵
    - Runs .reg file with regedit
    PID:2336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3524
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9E4C84F286329B5CE4BC36E9E11FE4ED C
  2⤵
  - Loads dropped DLL
  PID:3136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C6EACC469D378941B5FE394C96DF6628 C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5632
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3980C4E4F180B8AA1F8C60A314C4CED9
  2⤵
  - Loads dropped DLL
  PID:3292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0C1BB336971609AC712F37BABA08AA8D
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D4D22031934C179A7FDCD8EBB697EEF2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:1432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
4e35a902ca8ed1c3d4551b1a470c4655

SHA1
ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c

SHA256
77222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9

SHA512
c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\Topaz Labs LLC\Topaz Gigapixel AI\Topaz Gigapixel AI.exe

Filesize
12.5MB

MD5
ed54b3b33140f58fea18b296f2451da7

SHA1
cb73a7f860cb4e8d2318642d34c83b40da6731bc

SHA256
276cf21b70ed6fb8064d9d895644a7a21f6cc94a41d57697f9fddeb12ea7339e

SHA512
295a84636065a0159f679db7814038f6e569a25c1bb11a8ded5758e32cb180c3172f27c4772fee21e01cd4d7aede306d54d1cce5c9f831439edcdc14992c0682

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\18401

Filesize
15KB

MD5
c20a874add3067210f0f4e4e7683ab21

SHA1
05f888c56d0e0b67bda4ee04e36d770839cfbc57

SHA256
03218c5b03614ead9d7f9a64475f3544019732bd431c240cd809981e0333c859

SHA512
457e7b4a6a788b497469225034d01d62ecb3d53a9a493288835cab19d31f1e1e2320f7d58ebd0b1283ebfda50e4790e6b918e1e3f99b72f0d8d791ae8cabe800

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\25427

Filesize
15KB

MD5
3a99cf5136b80c9a12bd829f1089f8cc

SHA1
4c12c70d297399786c6059d763b609f2e5a159af

SHA256
268ca54228bf3c9b38e0dd103ca0fdb8cb7ff0dc8cf8440bda9030132fa20cd8

SHA512
2123d0dc541d4774eb8dc032de3798e7168d167db42391023b5a37a1b7855bff96fbdb5ff56a6fb5d9e2a38b201a3be1cfdc21e7d202ca286fafd4a078f1ee4a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\5339

Filesize
15KB

MD5
2d8472b3c6c39d289a9b61629adc8421

SHA1
00733dd32a9f48634f7005eaf755da449bd5a2d9

SHA256
9f82f3a4092bbcdb6083a64cb49d70ddb6dc6dada2635909b61a38d5890fadcf

SHA512
efa099d715d1faeea2ac98c0a160aeede4499cefd2aa1555e134ee7a535b8f163d60da5ae31b3e283152c57463b7c429156c48531ee50f52e4451a3e8e7435c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\doomed\5721

Filesize
15KB

MD5
25be40f79123be44f2e04b518878d67e

SHA1
ac0c989366a5b4383c4693567e2d2da488e77a03

SHA256
5ea7d3e1a1c2b4e751f64e221affd5c3d5eb3066a34d395812bc240e389e8729

SHA512
a7a37abdeae458a7107d59b100875cf78d96f26e18b278d96458500812c0d63f9960f16338ebac81efcc69f0b37b6ae57d14a6176f84d5081b172447d296b997

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\061B9F6A2AC2C8FBCAF7D1A42F5CFA9B72E8A6F1

Filesize
16KB

MD5
2b0843408669767a04b3676a3cf5d440

SHA1
28bee83c7345c61f66936453465ac9479a6b40db

SHA256
72a7fe4395f38aa283a54bfba6f2ccbd0b24fa039e78192245a78910d178b39c

SHA512
ce50a486ec26d4c9f42909736ca422ab53c6f0ee0d11639e5d9eb18e2b603b610322db7256d0a5f97fa41c643537f9306cd2ce764a5af7fb2096273026992df7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\075B8FCF1E4761117058C2EFF149858F93A6A354

Filesize
9KB

MD5
5bcf7e3bc8c70afaed3250b7061951fe

SHA1
6f22bf2a2596a1fe132389ac5446983a5ab166b2

SHA256
37d6d74912444fbb2a0cb97e4a8dfcd92d6c4f5c020431b2bb447b32f7f44e7a

SHA512
043ff9c210b120bd479dd8469eed320161f973bf091ac41c9aa0d4f9fda470af8888f65760e5c580d2a521adc03d1ab02f3df43994c2020215d0a199b3230c6d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\0948D58DDFD4CF66FEE916F9CE99EE22420BBB04

Filesize
9KB

MD5
fa1cff07f29929202fac6d14d68fa819

SHA1
c30a6172f67daaae443f447079be2961f7e30d04

SHA256
3e606cc100803a72865001a549303ab2f54a3a6f97207534504de4ec19505be6

SHA512
fb8016b3732ee5dc32a68f651321a612c63f77c952659feb995800229aff173c9d0a960f67569e843d274fe155f6b786aa41697c1f53edaacddf7e73b207e289

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\0BABF52A64DC7B1FCCDD563D131A086B80FE77E0

Filesize
15KB

MD5
65a10018cc6f9b60ca0f76e4727bb569

SHA1
bed0314df963f48f1c987dea33d012e2b19f3642

SHA256
2f517b6b8b0c1d8aa8eb05080f21c5f7d8c55b73e795d3fea30a582f89a3f4ef

SHA512
95cd400f15ebdf72e5c46d53f58d19d7063e36e8f1269171735196daf14354d0ddebdeb022256c259b471edbee730a5de3084066eb3334598886a3217947c0ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\0DAF5269AAB3BFDA433D95118D2BCB8CC1252ADB

Filesize
153KB

MD5
5589dfb583695e6cc361b018b0666875

SHA1
b14747ef402a93a27acba66fc369120adcecbdda

SHA256
be0f645aaf36d5390e01028b87fb352de0aae2e7c4320c8240b89c0bfc2d3450

SHA512
2375abb6fc7c1207289baa8eb1acfe780f16ace11d9d232bc5d579bcf9db5acea24c00f50fb54ec7c238b2055c8f9ea4fa2d3021f64b84bb0879d7e049bfe2e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\199F2C576B625586E546D1C4D46C6373709A139C

Filesize
18KB

MD5
ae3c4b7f094c64b03371bbb521162afe

SHA1
9255e6a7a96fc6c41856bff4b2b2bd9dfca853b6

SHA256
87e15ad77c44c5d3c6dc9d693f1053c1b86ac5cb8d67ae8c18a4c4f4b6c9c13b

SHA512
8e45c07d753714a08c80d6e45c6f7db1f65da16564817d2f38f8db8f592669ace0f8584d6e1c6fafe8e113a96a11e24f1a4ceca236ad31cd90d2d58e691b09d1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\1EF8FB498FCBDF982C2A04927F67F0F20F3447DE

Filesize
9KB

MD5
bdb05acc6e48ea9b702001de63232fa9

SHA1
85cd876fe30d8451835f3a4f2d1b4f92944fa063

SHA256
a0225263b917fd28a36d7ba03125bf579f63f63f3d10a84c174ec750476b652e

SHA512
8a2d9922787f05a8ca74f326cc097f58108e51f7f0ef32279b4cb9c5a2d1f918400d5c1b02865077f331b2c6efe7c35cdf8186fe1f47742a11c02874f6c90fa6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
5a03ab714f3f703d10601c4fae348620

SHA1
9c3e37f99b66decbccac9c88bb444a616c5f2e04

SHA256
5f70abc9c6a7883fb5451043bc83da75d691591a33e25ce0ebd669ee0ee77e99

SHA512
1a6d7f1849462057c7ccb0b2aca052b55ac4e006c64d3cce5e6039860bf843cf45714ed5eb64dfece7719214db0079ce686a28b1c826d15830a3518d879951a7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\2A6EC6487F6150003D072615C2B44761D0EDC9D0

Filesize
9KB

MD5
488d7d8f680c937c590036bdbb946dc5

SHA1
42032ba85a09ce0f800977bbcbb68657e6cc87e5

SHA256
1a5f76f35a3a8d91fee3f9eea09f6ccdecaf94a6d225ba38598da51d99466d3a

SHA512
a466d9ef51256b724ff5667f82f9da2b2fd3c62e0441424feb9ab9c527091651c658ef543ab8c3bd3a906ab54e5ca51f03159c43271e542bc3ff1a5a5cb8ab83

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\342DA8D31BA838304ECB8491F6FB97827A7D7838

Filesize
23KB

MD5
71e0242ad03faec77aa7bd3711547195

SHA1
fe2bc8d9899663da2ad0aaa9bf6301c8d00e63aa

SHA256
8bd2acd35a2d25fea0c65b9dfeb7b3d2313495c97be76979cffe449dbafcaef1

SHA512
d53ef6ed2bfa4795a39d90ef0e2ae0f09825ed5590acc9fef1f4f30ffe031f55953e5db84bc631ea38a48cb94c3d952e5a4ffc6916452d83a30495d7e63a0311

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\364583549B0419606F6E9E71FAB57390C4EE8230

Filesize
49KB

MD5
ea950dd227fd2ca07091d11ad8d34256

SHA1
4f3fd957f4587927a330f9aaa607a296d8f11780

SHA256
dbd7e6ea4293faba27ce1edad36c6c2391ac8c7fbb15373743ee530ec32f8355

SHA512
0a81805b3590a3cf64d37d09656802391ca10b422b0e688d6c433f1acff6cc21c18cab60fe6e050bf000aa9229e8b10f9490e56fdfed5002efcf6296e02a1bd6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\59875D4FD8FDE636AA808191362C474F23273812

Filesize
83KB

MD5
155fe36babe1e2245d2c35fba5698cab

SHA1
e00c7fd658710dda32b3606e858b24ec41d4ba45

SHA256
ab282cc1490ee01227b00427b6c4631f90c12223dffa2b9a76df4c149f5ed180

SHA512
78992aced926aa4d3d3831ea9acf0fa45ca41b02b587d1c9cd723a431d20da7987d56f4b1379d293a6bc1503d4b8bfee4c1dae78b1055563eb6f26697948a36d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\5ECA84E9978258361A5B259DDCE7C884E8C845B1

Filesize
28KB

MD5
985afc129010e61139b511535c762a1f

SHA1
38300330b4e4833258d8e4df47ed45a60e9b9722

SHA256
8931cc6482eaf210c9d7fc50c47be823b7661b4a512517819d87118326e5c5a5

SHA512
2de92d3650ef9f87063c7f0acbd6fadbff6d1d90821406fb0ed0d88656a19f82ee9fddd680d4397c762fc13245556c6f4b86650fab24767a60f2cdb3ec2523fb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\6CD66C161BE7D831DA0233DCBD5E657D4F3FF080

Filesize
22KB

MD5
adf063f29ed7ef791a0671b9d56fe665

SHA1
377d81b6f9c73c270587281d6ff470a4848b02c2

SHA256
35c128b824b6309ce46a07f61289735814f318d3a2aa9146540d5aa90c225720

SHA512
69e910bb038d84915d165410d3ea2a3a47e7203d562e397a9e995a0d3e6b0d198ed3941c6789f4f4980e405d6df0b3da3ef5eca14134d4b739813dbb66b235a0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
9KB

MD5
1d924748a130e8fc45dcdc4784977465

SHA1
33b48de11d478426177ab3b564d7a5a69381c1ff

SHA256
afda4638831e33fe1e9fdd5fcb8c8f1799b64be4e5dcd0e325213ef10f2627a7

SHA512
13036e3c1adc14a0d7cc31f8aa935620c23a497f0d1a5be87d7bc7f0e8e02fbf4b0bcf335ce1702149418dc951246a2656a6cc21770bf91386cd0c1087a91536

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\84AB27033F6F822EBEBBA03787E838F42A94F706

Filesize
23KB

MD5
7fc07376ce01aa68e31eeb8b07ffca20

SHA1
a35c4014bc06253645628aabe1311b6007230004

SHA256
f9e3d89251b2983a9d93be8e29f410a10841df7a2b2b80cfedef267a9a71f343

SHA512
20f9b5a177dd2cb1a58fae053120ca7075e6bb02f4720b6cb4d7e5aa099a11d928d9ab66feae94ea84463e96262dfa4f5eb372015981331c9424fbca9cd082b4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\8540EC873F08CBAD5DF5121BD3BABF95624B4A14

Filesize
16KB

MD5
73e4810a2e4179d71eb914b9b84bfc45

SHA1
098be436e0cc60d5f4cca6fb536be66ad465d6a1

SHA256
3d90ca216d325044c839999f73e9042e3fcbed93f7459c33461bc336f4adfd97

SHA512
966008740615e11bfe9652fa01c22654c78f66c2f6eef7b65f9c722496f742ee54baa5a492ae0912fe9b9a8be109819827f9448b39329a77cfbe4728e05e7550

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\9BC6C94B3A186FF0EF32D95C5F699D82DA6539DE

Filesize
9KB

MD5
8984da9dc27450ef41e9e558de9b2f96

SHA1
a6a087197add31df0820a7502ae285a02813e937

SHA256
7ec554648dd4af3d99246ffa315a6e35339b1c80e734e3d650ac96db0bed8bfe

SHA512
2fea3716366aab4f94ea43eeba3c8548617fdd3cbf3e8f261121ec43fc0ef89cb5c02096bb5f46abf13e2c35fba69acbd53bb4305ef9120f717d2fd96ef21e4a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\A55672D86D6165AD5E3F0FFCB5A58355967E2AC2

Filesize
34KB

MD5
91794ef42a592d8a080bdeb9c5cb3e49

SHA1
8eed6352401b3fc32713a5002dcfac2490de7dad

SHA256
94152b77d2a975e511e40bff5b10b2bd51d64c5dcaad95261a79afe0ac5880fa

SHA512
9cec7ce7b007fb00d9bb3bdf314c87fd377f03d90c00b8dcbea5c928f7b8d1f57b50ea36cb3ee315e4f806a0d64da5ffe591d5ba0016b6a5bc5091365a927dd1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\C2C62CF80A11A42C5484749D5B893926E265C471

Filesize
9KB

MD5
0ecf31965a4096657aae804db4a8c680

SHA1
9b43c0cdeab1ce9fbaa4e29726e9e124eb6565f1

SHA256
33483414971ac8675e456771d438582ffd19bf9ceccf59592d0317e0c3a79446

SHA512
75a291eec3e64a6fdb8bd10438459c5268e8778fc21c2eb7bf287963dfeaabb356ebdba92e2ca01e076b2c2dac6fc496cf259a48f7a14263bb63481fd60f2d5d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\E98D316D1A4774CABF26F5062A63E50CBB9F8FDE

Filesize
365KB

MD5
ea48baf9d8e9c0b3c143d659f4a82624

SHA1
65e63d643af406b22bcffe6cb9a1607a07af9cf9

SHA256
3feab7842a5dfcd44dd6d905ad0933e10f848b1212d0c3c507ae99583822968f

SHA512
20c7488a2d2780c3bbc23cb75d694784cf562a282398bcc9269d875fb44c07377c205004c6bdb8bb10bb9498a1c531cbc3717e4ebec4bbf4fbbe028a3c571787

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\EE731C0E0D731ABB74F4BF6742D3BF7B6EAFB930

Filesize
16KB

MD5
632c6d15c6ca5cd5cf98f69084438566

SHA1
f30314c9b3686de0f64e6d4cbefebdf86b1c764d

SHA256
ac4b1354ef881b7b915735e92e747d49475755f31a9172c659cc5de10488e05c

SHA512
5b09a766f4e37aafbaba50b587da111fbca67e72fd3fe3b1586c24231c7f73ac95500cd8ee7f98424952f1bc720091bec7a3bf9300ca0532d2cb0b365e586b26

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C

Filesize
354B

MD5
7dbf12217a50ef9b79af5c9c2fb91964

SHA1
53ebb81d70e8a15d4c11a58b83fc00c334aa3cde

SHA256
f5ac3b939900febea6e2f8ad3f80c75870a8b33a9c32fac1fafa9fb92a4abbb0

SHA512
34d6c7be2a378f3c838e41d0ff55e730e56a622518baa59cb2ed29630386eb7eac15eff3788a04672a6ee6c58533d6e0cafb75bf499a3cd661aa1ec9aee69325

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F

Filesize
30KB

MD5
5e36a7f46b64c65c5b293097a4339888

SHA1
9814a7539b99f490c559cbd1287edd1d412ad077

SHA256
80a4169c7edd4fec981ce33519b6f97b6d57f45810436aa024c6d3fb63bc5acb

SHA512
f5fc139f40ac9dba9472cf707fedc742f5b253c9e7f50293edcc7901712e5b0c4fc626283c6120eb6197adf0b77ed29849d776d74334bffef3e538e57539145e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\startupCache\scriptCache.bin

Filesize
7.7MB

MD5
d8c4063fd2c9df4e853d3e75a3701d27

SHA1
43c175b11cb0dce68717be8d4e6a08d7f084615a

SHA256
1c70c82f9e51d03fd6c05b586bf14f6e9c616e1b3c5bd36e15e70cccea0970b9

SHA512
38bf571d665bd766a4bd8464c95e8c3a5de852a9bd96defc3f8a61e39d393a1ccf73fbd85eb95de09e38ce14cc09087787e424c41ac126a97dc9545b8ed31830

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4s2odj76.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
f10da01530aef24dd84eb6dd59d4f038

SHA1
c272b2ec5c61c8b07ada6fad4b13ecae14d7893c

SHA256
a15a59dc2acd6c46eab8387f9b13b6e580c1372f66fcc5b41828eecbac9f79a6

SHA512
e818f54c666a259e61c8eda531c15ec0fe5c3ca7fae290182789ee4fb5cb409695f5a98b349c9c0b8f6ee7d010b2967d772599dcbaedf344fe74b694046e53f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO864821C8\Patch.exe

Filesize
62KB

MD5
ce05447157c7ef90eba3fd8f964de822

SHA1
f034960560285c2b5d563a615263baa44b49d670

SHA256
9069e06079e1e69fe4462096859bbd6feb1fc7e2803c285bf7a3498382f93095

SHA512
60820fbdd9d8f726e15d33b71b6873779ac649401cd6854f5dc42c27d257dd467bc33dd224883a7c8e9e3801fe443f0dde98890f1468891cbc405a42b9e0e7b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO864894D1\TopazGigapixelAI-7.1.0.msi

Filesize
708.7MB

MD5
b5a724a9e48dd3a5494bc5919d89512a

SHA1
014e139f0fc31bbe7321556b4738987752065623

SHA256
fc2b61899670475c2585a420a054d6fb48a44569f8b3eb00bf5b0ca6bcd0b571

SHA512
7f4b227176f15d43c56865ab644040782ece7345818268da44718cec041037988f03f208550f8d7965f983f3f64c5a11206b54aa5e9f5960d7af75029e97ddb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO864D0291\Readme.txt

Filesize
485B

MD5
8e188af9d329fc2c933a3216990a5610

SHA1
c18c9b864ed1c28ade11820b4cc75e5fc7a0219b

SHA256
b43538fe7a602e13c82af920d953292dc2b034db5e1a655f3db924b3ff582cb4

SHA512
1c77d5c9b4d55d37b4a43c5c72b44235360248b3904681910bc248d6744cd1999dae15cea0e4650150cf951e4e449e5de4e531c005bcb9df9fac3a64f4d3ca1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF6C3.tmp

Filesize
2.0MB

MD5
edc85481ced3d9f16c79f1155991ee97

SHA1
ea0d7a0996822ccac0dc36d9e8351918ee2e1a5b

SHA256
52b6adfb416528f147842f3291ee92666fbf9877084aad5629a99a47d2eb7349

SHA512
56353aff3c701804938a324c5c749b426e33d250e05768e2d376e89aa07bc7798cb6eaa3968d45226c7538b03ed6911ce1feec527fff3d9b47bbdc95c941153a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
56KB

MD5
34887489d2c8963dcb4ea6baf78f4254

SHA1
5821fcfe7ebafac3d569e6da18720fe0619ea162

SHA256
4ef87c43607bb2c8d9dd813e91a2c8867ad50f0166a12da853d16c2df913182b

SHA512
c0f1a3182cd9373a7bb0d12470d6668fdfc799436986172885aaf1040ee878878b7f799f8c4424e92fc610f21833f0022a858e123b29de7d669e21542c9b02dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\AlternateServices.txt

Filesize
1KB

MD5
726a86058f11cef910810ec9cd81bf97

SHA1
534be96c3936a7b1abd75c685d76bb8f8f0ced9b

SHA256
3641a42aabf0ad4c3f1031977268e0f24c351f969ae4ae0a0262555e4c2b56c3

SHA512
3f2a153113f52db1aaeebddca78c2ddfe6ffaf3a672715875d7603a0d968128bc294d4c09d41f127f42e6eae5a9b4d3babac3583759d3d70909939996c60583f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\SiteSecurityServiceState.txt

Filesize
540B

MD5
498cc9c5c2ec2f4d244ec12a03f995f8

SHA1
65c6f03b42e734da60335ae32e8e9282062daaf7

SHA256
36a72dd45b9f4e7efde08c32add0186ada08945c37ce7dc7adb4aec1eeb4129a

SHA512
63e0047ab51c9d8e67180c47efc0e2c3c7aa361a5edf18f2e839a50e9212f388639e1ca981b91411a17c11e3fa199a9a5ffd570cab23965b833b4da9edf25c5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\cert9.db

Filesize
224KB

MD5
14eb669287d656808a50b67928768cba

SHA1
df78ebed19a4485631f36c1f9845ea15babe2bf8

SHA256
2757c3b71964d57a6e2fc4d151e45eaeadee9f4023da1fb824ec0600fd740e10

SHA512
1333598e7ab4efc4809062c1d2edc690333604b4da603f18ef591a17e22dff25c386a99e7ce799f8b47313295527ce2a63574b810ea94f88f89493df6bb7143a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\cookies.sqlite

Filesize
512KB

MD5
b1cdff8f41a41fa268add45aeab8a533

SHA1
957f05e6abc7bd6c00eeae75d21dc4742dccfd06

SHA256
025e13b4fcd0703b0c68815fa832dbbbb31ed36fa75a614130f15ba25edb346e

SHA512
44c586f741a8cd8d66608b4e40c26987a710f759070a25f7e7f4ec12b98e7cce648d9d70d39799469e12ea19fa636fe2c44c310466e62e9976dc32c8a0b58615

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
16ca1f01805d33e0d654460dd2638f8d

SHA1
e9b91c2d0b358f9679b66e23e33fa1a29ae342d3

SHA256
9f5c2b117170ef6b992e15285829d888f561fc5cc028c40373ee4165128e110b

SHA512
9641356a0c487851fab343697c330e5cfb4747c296bea74291aded9ddf7fc8cdf512dddc79eb4bc0472ad77d1b04db6b62eec4b7a642c03a255781a011185ae3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
3d9bd53ec15b3cab4d7a31b1f29131c7

SHA1
a6ed7eb947c9c6de1aee105e1618a8c051415669

SHA256
ec57b56ff7a8962d87af74c3a4374257371456277d1b93d19b8eb7ad6c0fa1d6

SHA512
5c48715e2f6738016c32529780471fc4128afb4dc2bd19a4580653df15a0fc561e5c6c38044146f435774dc451dc0c8bda39df0ddff9aa2b0514fe72760220f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\db\data.safe.bin

Filesize
15KB

MD5
7bd70f19adb652b846a271f7fafc5d16

SHA1
dc3cb4d3445c444f909403f300e9ebd145ba0775

SHA256
04eae5b6977f8bdedf2c04c08a72d2151fd32d3ab5aed38bffea7ec027b547fd

SHA512
01a56d484bc3be58a258c27bbfa68326ae1882448f42192afa0c841ef1bb2f965b3004154ab25d246f8031af33f487830b46b3563a13f0ff3e7e4b354a617c2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\events\events

Filesize
320B

MD5
8e0c89b3470267021aa4e4faf4e059cd

SHA1
955629a2bd257bbf70621c355a0d2cfe8f24b217

SHA256
505676d68de946659252ff49b7b84c6e00ad733b500a0901dd4f32fdd79104ae

SHA512
2151106dcf18974ac67450f9540eef5e0bc768ed756324e6fd15696ed085db4c0427ad7bfa73893056af84d2aaad976404b08aeaa1d9d1832780c219f5db28e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\229ba3a9-3119-4110-b04b-d5da62c83c7a

Filesize
746B

MD5
29ba8f67c432c18e310a671c20c77950

SHA1
22521bafc0562600cdf8b6e4edc030d858cde263

SHA256
22ad7c2d28749cef152754f83a4f78d7d63f4e0d48dd79657a7c077554edbbc1

SHA512
3e859b72155ebd274daef74389bd3a0cef0ed9ef0c5a3a6bb428e923e13567cdcdbcb731a30bae460f0dd55391dba177b854121a47591ce183c246b838a10c19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\3981831e-f78a-4e94-8b57-2c8aecfff7c6

Filesize
790B

MD5
6883bfc25a69bd71f871732a1f4750ba

SHA1
5898bee2e5c134d634cf6ce6f85f1938d1ee74cd

SHA256
e2d55f96544143b0b8436ac4920dfa371bedba6b44d595ebccf05f68d30d8d7f

SHA512
446a3f09e83f099fa02b1ad9f9f5373f9739cc2c2e641eeb3bd2a86a156518b3f651b07183df58818ca5a71a296e0dcd301ba0ef21f65da98cd8eca86bb8700c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\54d04f8e-c682-49c6-a293-9e30a1ed79fd

Filesize
11KB

MD5
06091ab0e76b8b39c537305cd90bd7c1

SHA1
e7eb4150ab086780d97239dba4c0cd3a0470f21e

SHA256
c1e3bb033bcba767ec678121579a4698977eec095ab201ee18eaf04f3e5cc109

SHA512
5980d2689e45fb9311d4397ec243770153081c41b8598ad435d2f41339e1180587c75f1482701dffb59b926e5968fae845290dbeb7146e03667f93743d84ed9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\datareporting\glean\pending_pings\cbf976d1-f24b-48e0-9c52-d128b9d67627

Filesize
925B

MD5
879442b81e04bb3915a5481f24312952

SHA1
058ccd83b8a29d76c755ba3c1c46683e5299c99d

SHA256
5cfd51784fdcdb745e1a3eedcf124a05d80f7cffbfa1da12ffae5fe6bcb45551

SHA512
51393b7f640542980d5ebc279b3106a0af779eae2f0d16930a3f4120fe6a9b9a36c0470f32ff6dbb1baecf87912fd3bc44bf1420f1d64d77360b97bbaa3688c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\favicons.sqlite

Filesize
5.0MB

MD5
45fa82bc4cd1108ea59b405fdfbad0ff

SHA1
40f904dee044c7081680305d4341b11984c65c58

SHA256
1ecbda5b89d198531d3aa1ab620fc94cad778d011524d187bc57cffd7441663b

SHA512
bc2f27bb6eada67d5f3da35077ee8579a7291aa8e2b1c3d83d936adcd1c816df55a6f30de92bba237fd9bb337b278d69d1b7fc8bf54d1fdb8d2dbd095e2543df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\formhistory.sqlite

Filesize
256KB

MD5
4cc426f046abcb91bd5fd80c675ee8d6

SHA1
2744c040589f75717a05c5b9bd0f81b8ab019bb4

SHA256
6be2240b6b6bc74019a91a2bdee14eb491aadfce1725d1317f30b517dff58790

SHA512
c1a2291f8cc49f4843302f2f18bb922dac7a3bb176d0ae169f58bd93a6ada9cfdeaed6225defaf99425552eb9bfb2e11ba74c04d4ece49df4fca50c6b6fb6f92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\permissions.sqlite

Filesize
96KB

MD5
c0ae6a19ee63d190bbcd4ab83c7554e9

SHA1
c760b4ab1b65daec9dc7a26591354bf6ece91c4c

SHA256
7028e6cf30298573d8409318f264a12728d6c1ff12be0455abd6a1b7324e0877

SHA512
ba7ef07eef86a8a26fc47fe41bfbd24e0fadfa4f6dccaf3841898ee945ad57931c09ae92c48aadec3460a4c0a3e5cb15892112388a61c59b2e514191a4bac6aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\places.sqlite

Filesize
5.0MB

MD5
0cdc42ada4c61125fe64636bc149735c

SHA1
e32fa3605b6d818a187258cce50293d2cc01f4d0

SHA256
fb19fe95bfa6ebca549009539d821157099159d64e3f7cf4395e842d368effce

SHA512
a526d480191ad7bc258b5b26c1ff942c8e9edd20209460b12f5a2fd350d56ca0f1a0f54815b12d4b21f82afbf9399a8b0951e6a9d3735641235572c477e379e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
be7fe08634a86f3e4824cb2d577ad828

SHA1
c7c9d8024b93590002bc65a402457a6d13bc897b

SHA256
c97ea74039b22fff79eb1165450364624c6061f03f291f32d43be1b3e3c4dbb3

SHA512
5f0acd119438bdee31e0d83a00bf34a63be796e19cd2168b029a952a998ff2fe5bf9456da6cf3e5a58d9c29195cc104c5c911cf848bebd99cf6946444e7a4c2c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
7KB

MD5
9d834800dee9dcdda5a57b807cd724b0

SHA1
f65adf8a93f0111dea20e6753aa02dd5ef984c11

SHA256
da95db448a0498643e2673e853832c2959b43ae4988ac2e173e28cf766da2819

SHA512
b9baf5fe32d7873e48f73b473d5e4fc07e4d1f17c0516c8cb517316836ba85c61cd450b166cdf967f4e790f800896850f61c6b443fb5c1b78336b791ce07f84f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
6fe8159b80c1dbf1a692ba6c7a2bc946

SHA1
8e2724ff514c59d58fe0fa2b2755011f6d59f547

SHA256
e73cdb94c7ef684342a7a49d46d4dfc9dabbd00c889fb0af567c20d64160ffbf

SHA512
6f4579863031eaf8385f2cdb715b136c2d66daf69230b1d8cc745af991cb24aebb93d4867945225c9c83d591416773e12e0ca4ccdace06b565904a1681cbdd47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
fe7fa5d0c436f4120330290885d6ed60

SHA1
bf1e98130b90e5392e120a4f04986af8c1ce85f2

SHA256
6da2b83257b71cc05fad94511e6d52f6bfd693455ad273a1e2191f6cef23088e

SHA512
4a8c9adc9311fc5fa16800cda6c9f224498056069f1e934625b2f06abd881d078cf4e85ef60604c53f2dbfb902ad5a5597ccaac33b256315eeb94467b6e4e775

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs-1.js

Filesize
6KB

MD5
a22a9c8829dac631aaeea1801370095b

SHA1
6ad19c280ba336ebb8a26092f9c503d0eebcb5c3

SHA256
556fc721a185e0d538df54400f211bee85bbe38d5f2efd2ab289b3f23a7c903c

SHA512
2f5cd91554450bfbf58bbbdddefa37133263cc1116412f6dfd5fccf8fc863cf0bb720573344478d3542a318a4f882825e542873ff368ee585170dc5aacfc4296

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
c797004a7ae90d9303409ec6bfbb1c4f

SHA1
0796568506b4bb5e06de1f3c317e1e5ad67dc3d7

SHA256
494c50fc690cb1999505c187af8e7d4e861ce25aa8cca89970aad75afdf06ff7

SHA512
d05b88477f9ea70b685ef69c0f604588e23be7f8b1fe0c66ba97412a8a3c16101e5873f60e82941dfa5e3e15e32b5dbe8d936a69889213d21c5abaead9a4676e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
7KB

MD5
4399b31087bacb8e770965c97f747432

SHA1
c44acc9cafc7698b34d95433de4f64cbd27f7592

SHA256
6a07685374c2db210ae7efe0594b5f09f633068c1dcd330849d24ddb40858c5d

SHA512
3caa0474a64291e7b9b3fd59af4fd77660f424cadc2e9b41584f42e67ed2fa28ac2b07a34f696b923d554ae2118b68b59871ec2def411b6be3ebe104f28c31bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
6KB

MD5
086d12b8bf3d1c54716295b90f14594b

SHA1
238f400d60301d8c9750f44754704b3c367bb136

SHA256
47f8dcdcb8e87d92640f96c75b111cd6367db11d388e6ee753c5babd41c2c1a2

SHA512
b1b9b9c6506eabdb4cd11590071f823cff6dd709a23a5387d20f2599ce985f04cf6b01d051bef09209b265796118dba0101da4e9e2de86cf4fc27e7b2d1c77d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\prefs.js

Filesize
7KB

MD5
c83849b19deb25783969e8d1f5e913f5

SHA1
2fbb2e985df58053c22ba57cc58b27cdf8b1fb78

SHA256
bcf7c368ec9a72dee98379335667a0cdf571ccd7d96c16c1d52c756e16b1d9fb

SHA512
a34938cab64e723723f8cd92754942eee7081fa6144d56fd3073f5c21e065f991e22193f7a1b6f3fb09caea10e870b3fe279c79133c560b6e1e396a699f96aea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\protections.sqlite

Filesize
64KB

MD5
deeced8825e857ead7ba3784966be7be

SHA1
e72a09807d97d0aeb8baedd537f2489306e25490

SHA256
b9f022442a1506e592bf51284091a8a7fe17580b165d07e70c06fd6827343a54

SHA512
01d303232d6481af322137b44fef6c2a584f0643c48bab2836f9fe3193207015da7f7514fe338500ae4469651e3d9618293858ae507e722198a249257677099e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json.tmp

Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionCheckpoints.json.tmp

Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
957b1ea2749c6463c5d81795551b0c7e

SHA1
740b336c7f9366412a2e6b6b6bf6fe66969bead6

SHA256
eec07aec9862d0442e52eecd25b4d0f3552af4583eb3bcef31da26c10fa91fd4

SHA512
456449ffcd12b1137069c107cc3e789d3fd9c76ad33dc0120cd7d3f7616004d6eaf29ec8f0b00c18cfa83eeb9508ce57df1366706574768203faa7cea7adcebf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
0d5ee1da2f2b76b154cdba9ab8396b7d

SHA1
3c58cecf123c7cd5ea1d963132df14c639cdb560

SHA256
81b7b9d74dba3cb935b369f9d90e7d106ad68f6cb71061d04ecba58d6ba74c06

SHA512
4ff5ee916fdd96fc6e6900a2860f64e6bdf9b66a487ca41d6f1e7a3a456a0b6d12ce36828d1d0a74b823895682b137c89d9f6f187823736e92b05003a250253e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
d3b5aa5246fd2ff25e9e5a25d44f3b28

SHA1
5b5149ef16a64e68b777bff49ced75c0c1858ae8

SHA256
bf836aa99df5de098e764ba38a9f7f70af0334c617080f0c27c3023dc63f526b

SHA512
7c9a22030f24a0bd53bd7437a295cf14baa1dcb36d127794d441a676659485f667163564f90e750c733e9d89c0dae8661b7f5e3695d6c234e1d8b9a20cce2e12

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
053d327fc1e7f33ad4fa8c3139351f0f

SHA1
40637745c5d4de47265a3b090e3ce56a9c06921f

SHA256
431cb763c4605f67cb8d15edfcb5a18ecb08271151d4ecba4c65a7322f2bde2a

SHA512
f65dcca8a6eafedccbe88ec2250028a2f77ca35a16357c73a467c5b7108ab887a3b86a1afbb8383db0366d6c68aee5faf5553aeb9911bf14994b96d9347a4232

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
89f289eb4e663b260796cc871e0eca94

SHA1
d8258d159805f373cee936d7a1e5a6000af9ad67

SHA256
963c311d3871f691bbc78f0df94d0ece79db2530a30deae9d1ba8b3794339bf6

SHA512
d11e93dc665ed94498ae7d1a05fceca6dc41e5f7e69b236b6ad60a8d09b0f40cc981d53f1bd79fae88fcc3624f0f2c68e71e3e42de0827e494ab10b7ac956e2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
3b7c075567974c9c309f58ddaa1ddb9b

SHA1
746935252c8c46cfe195bee2896393101d9fd9ac

SHA256
aaa7151cb86eea895e674a7a17af869572f83543582d3d71c1532ba7964b39f4

SHA512
be0734a5e0895d12b9dd3d7a4ef46d29c0107c85b8866e3739ad20662547c52a8ae0caff37eda18ddc9d1390a32fb0f5c154b65573cef01ef02417d3b8c2d25b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\sessionstore.jsonlz4.tmp

Filesize
2KB

MD5
f2b1b4728bc6755fe790cac9473c8a3e

SHA1
cee46d97d6b7a9240f498d95dbc7c6e69a202aa6

SHA256
69c961cae73eceddd3a4fc00da66fc9ae33f77c5d824321cd46edfcf219ba2df

SHA512
03e50be523df7e233849766773718a61b4551db569f80020c703d0951a234bb8268ad75e2afc23054fbe1db220888aa3aab55c5b94c5fa3232c577a5e7437109

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage.sqlite

Filesize
4KB

MD5
53eead96fad9600b85d4f3ccbf5ae309

SHA1
505a5a1a13a1777843d0cde6d3c4d9206e6c339c

SHA256
4e7fbf5e788e0aeb0f51ff43ec7613fcbd2de9307875295b5ebb69cad67e211a

SHA512
dbccabce67fe3138af3613eebbd36b0defa1397bfd82276dd158ae40a73969a0d7f17e568e0f9bf9fd58ebbd91922fafb7ce3acc6b3140ce70b2070ea3924803

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\default\https+++www.google.com\.metadata-v2

Filesize
62B

MD5
dade8a250064a76398f272e5c9a65e0c

SHA1
ee2de49905a5def796e1a106e374fc7a25f17c3c

SHA256
c4cb1cffe43d13c9be8039eb1caea8ea5b2c23968c1ba884570bcc666122ec03

SHA512
c3128bf70511ba7567d935ef72dd1dd894e8271b9c7b8cef533ff6e1cc2a657bc9f484aa0abfc78c6de155da6ecf0808facfca171e308a15efadc6cd8fa4817a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\default\https+++www.google.com\ls\data.sqlite

Filesize
14KB

MD5
6cf19c542117b9461223884388b898f2

SHA1
88db51e354e4f891e73a4117bdff186c69522706

SHA256
4b2b7af38becef00e28a566cd0bab04f266a64f56fd7610102386aac20298b1d

SHA512
7387b90a88b24b189485fd3c8433bb089fe501d2153892260b4f7d2b4c38e766ed8b875dbe020c8290c71318e3e5491615d2e496a3575d64fb4c7d3a83f573fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\default\https+++www.google.com\ls\usage

Filesize
12B

MD5
3567d5874c2c216b8c1c7af5a2bd1fa2

SHA1
4424edecd92c42ec1e5e388ca05aa820c32bc57a

SHA256
9832c6d3dbb80ec618c2b77e98efd47c5d51493cc0c1616a6f939558e3e96b19

SHA512
4254df1a693279ea2bbd20364875566d384f105a2694c9462aabc939309dc6f613c742f9e615400b63647867ea4a8fd26dfe0ed5c27a149db605918da4b33716

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
da746ef94e09a0f0bdc5ed34fb8de1f6

SHA1
4511e5aa8a9e25cfc2a8059cbf30933610b4361f

SHA256
7538c802b70d7b6843bd300dcffdf36fe55f3735031789a1c4f090ebc336090f

SHA512
8f9369436a10f82b9aeb16e115149242a7d07baf790dba0992894b4b4e34075ab58906f4f3424d2059e49c6e70ac0ab6ad1587520ee6028fb91678e73cf0cb99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
89fb414d778d11d3a12991de60301815

SHA1
1d7a63ca92d9ad28930ce2feaac8c71c3f699ef7

SHA256
935ba660008416f0b46a028a709944f11f9c2858243a2f7bc0b57aa1d96314be

SHA512
49f06dc78f2e08621ba4ed19925d8c7ed040502f13edaeedc7df3d675e77417d8b7b3c0b3feaf7f4fcef989091b363f5af1fa9258de57cee5bd904e1d7a31f9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
192KB

MD5
5ae65b83cfcf859c34f725b7260f1dc5

SHA1
0f02d6803ba4a3dc86876e5093a460d2f2af94ba

SHA256
2fa352910827bced36d2f39f821a0e7c3444ae48787e424157d2ed8d2dbe4da8

SHA512
70b16636fb4a91f5888ad4ef6dd085a635fdc47f5e352ea77c77f9903e6c7f9bcbca8489c29837c78587272a0576b4b2d19d2d9721b684c8e53228ae9a3039a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4s2odj76.default-release\xulstore.json

Filesize
120B

MD5
05e1ddb4298be4c948c3ae839859c3e9

SHA1
ea9195602eeed8d06644026809e07b3ad29335e5

SHA256
1c2c5d5211674c3c8473e0589085499471399e53e9a85d7dd3b075fef6cbb6be

SHA512
3177b48cd0c877821419d7e5eb247a4c899bc37258994f22257ceaafefb316e6f5959faae02e380e432d7752f0218d45d56d6878c1e751d201d9fdb3ff98612e

Download Submit
C:\Users\Admin\Downloads\7z2301-x64.aRDLTRwe.exe.part

Filesize
15KB

MD5
5d06a186d98c91ad9f4078bcfd696ed1

SHA1
f73e1a8eab6d68298e9eee53c5ea3702cb7c1976

SHA256
9da2a0226c2c99ed6578c347e09c67b1dd30ce9f4b4634b635a73127871e27c5

SHA512
8368c7ef298e9fa55b75d8464c8306ba37ce44d0e0dfd65cf5f9e837455917ef33acdad82254a0763efda2940c06dca28ad064e602d17e833a956e9e99aea83a

Download Submit
C:\Users\Admin\Downloads\7z2301-x64.exe

Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700.9Zh5e-WQ.exe.part

Filesize
79KB

MD5
111a9ec7b7fe17ef326d6d07881c1bfb

SHA1
ee5cb55f422e16977c86243e5b2f83a17851aa2e

SHA256
a09cf7f680a4599730b1d5223540801abd445ac5d8a227f24bcdabab8f2e0fca

SHA512
ea203b9986992c2a10f88f40dceb935fcff24131b89fb09355723601847d16a8e34137297212d357e8d0b8d9cbcae6110377b72322b32fa39030b113819c3790

Download Submit
C:\Users\Admin\Downloads\winrar-x64-700.exe

Filesize
3.8MB

MD5
48deabfacb5c8e88b81c7165ed4e3b0b

SHA1
de3dab0e9258f9ff3c93ab6738818c6ec399e6a4

SHA256
ff309d1430fc97fccaa9cb82ddf3d23ce9afdf62dcf8c69512de40820df15e24

SHA512
d1d30f6267349bb23334f72376fe3384ac14d202bc8e12c16773231f5f4a3f02b76563f05b11d89d5ef6c05d4acaacc79f72f1d617ee6d1b6eddab2b866426af

Download Submit
C:\Windows\Installer\MSI67AA.tmp

Filesize
154KB

MD5
b2e2c24ebce4f188cf28b9e1470227f5

SHA1
9de61721326d8e88636f9633aa37fcb885a4babe

SHA256
233f5e43325615710ca1aa580250530e06339def861811073912e8a16b058c69

SHA512
343ea590c7f6b682b3b3e27fd4ab10ffeded788c08000c6dd1e796203f07bf9f8c65d64e9d4b17ce0da8eb17aaf1bd09c002359a89a7e5ab09cf2cb2960e7354

Download Submit
memory/1296-1937-0x0000000075320000-0x0000000075346000-memory.dmp

Filesize
152KB

Download
memory/1432-1885-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1895-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1891-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1893-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1894-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1892-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1890-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1884-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1432-1886-0x000001B7F7610000-0x000001B7F7611000-memory.dmp

Filesize
4KB

Download
memory/1996-1951-0x0000000075320000-0x0000000075346000-memory.dmp

Filesize
152KB

Download
memory/5272-511-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-504-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-512-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-513-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-515-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-514-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-516-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-505-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-506-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download
memory/5272-510-0x00000239D5010000-0x00000239D5011000-memory.dmp

Filesize
4KB

Download