Overview

overview

8

Static

static

7

Styx Clien...st.dll

windows10-1703-x64

8

Resubmissions

04/05/2024, 02:39

240504-c5lynsec268

04/05/2024, 02:37

240504-c4at1seb777

04/05/2024, 02:33

240504-c1tsqaea987

Analysis

  • max time kernel
    920s
  • max time network
    875s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/05/2024, 02:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Styx Client Latest.dll
  • Size 4.2MB
  • Sample240504-c5lynsec26
  • SHA256 2d1307efa269e7f18f1818e672c028c76de3cb3c8ec3cd3c2bf9816bddf1a8de
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
microsoftdiscoveryphishing

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 60 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Detected potential entity reuse from brand microsoft.
    phishingmicrosoft
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 44 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Styx Client Latest.dll",#1
    1⤵
      PID:4988
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Checks processor information in registry
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.0.887999712\4506403" -parentBuildID 20221007134813 -prefsHandle 1680 -prefMapHandle 1668 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {973c0e19-468f-4676-a9bc-9a7e3cf7dc30} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 1764 110bd7cb458 gpu
          3⤵
            PID:4692
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.1.446050010\874815219" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cdcb06f-ad29-4352-aaea-30588d917ee4} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 2120 110bd13e058 socket
            3⤵
            • Checks processor information in registry
            PID:2496
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.2.1730042422\478737894" -childID 1 -isForBrowser -prefsHandle 2692 -prefMapHandle 2700 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca3adf41-11dd-4081-86db-3f012e2dd24e} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 2872 110c16c9b58 tab
            3⤵
              PID:3608
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.3.1237374397\336167953" -childID 2 -isForBrowser -prefsHandle 3416 -prefMapHandle 3412 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70f24b6b-1cc3-4684-a48c-4234f10f1995} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 3440 110bffad058 tab
              3⤵
                PID:4288
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.4.1307325138\1903305291" -childID 3 -isForBrowser -prefsHandle 4064 -prefMapHandle 4060 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3ea410e-b63b-4783-88b5-d4cc2a6295a0} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 4044 110c2d67358 tab
                3⤵
                  PID:2532
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.5.2137342071\346219502" -childID 4 -isForBrowser -prefsHandle 4840 -prefMapHandle 4836 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2e490e6-e1bf-4504-9b89-71c9ec27574d} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 4828 110c3e90b58 tab
                  3⤵
                    PID:2668
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.6.1978944985\1706004815" -childID 5 -isForBrowser -prefsHandle 5008 -prefMapHandle 5012 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4551e302-0f90-48ef-a9ff-a16fa5980735} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 5000 110c3e90258 tab
                    3⤵
                      PID:3808
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.7.1661281400\290559133" -childID 6 -isForBrowser -prefsHandle 5192 -prefMapHandle 5196 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c286bc1-11f6-4112-8373-4d1d4515b70a} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 5184 110c3e91d58 tab
                      3⤵
                        PID:1628
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.8.1294526182\1450361678" -childID 7 -isForBrowser -prefsHandle 5640 -prefMapHandle 5616 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a690a82-b350-4099-8538-fbdf0ec4b531} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 5608 110c4d47858 tab
                        3⤵
                          PID:692
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.9.1108011127\1032360864" -childID 8 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 26786 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {456f2dcf-4a7e-4d90-b771-95064cd7026f} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 3736 110c4cd8558 tab
                          3⤵
                            PID:672
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.10.1684406509\1525640244" -childID 9 -isForBrowser -prefsHandle 4404 -prefMapHandle 4464 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd05fbdc-716e-4f01-a1fa-18d9ed958f57} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 4372 110c652ca58 tab
                            3⤵
                              PID:1172
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.11.2086820277\1980549273" -childID 10 -isForBrowser -prefsHandle 9808 -prefMapHandle 9800 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64cc2019-a515-411d-bda7-33184f58c6ae} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 9820 110c6e8ca58 tab
                              3⤵
                                PID:1712
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.12.1862435797\700863164" -childID 11 -isForBrowser -prefsHandle 9656 -prefMapHandle 9668 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a93652e-333f-46be-9bc4-34a17611aee0} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 9620 110c680ee58 tab
                                3⤵
                                  PID:4944
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.13.600509945\1384528513" -childID 12 -isForBrowser -prefsHandle 9432 -prefMapHandle 9436 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a61f0e25-33bd-40c0-88cc-f97293089635} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 9424 110c6810658 tab
                                  3⤵
                                    PID:4852
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.14.1263421710\1911442167" -childID 13 -isForBrowser -prefsHandle 9284 -prefMapHandle 9280 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2a52eff-ff29-404c-814e-418e522610e4} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 9292 110c6810958 tab
                                    3⤵
                                      PID:1908
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.15.544954875\1219671556" -parentBuildID 20221007134813 -prefsHandle 9220 -prefMapHandle 9052 -prefsLen 26795 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8b4fc45-1b46-48eb-9ba7-632d633f8704} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 4944 110c7947a58 rdd
                                      3⤵
                                        PID:1280
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.16.1274785811\1815818950" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8972 -prefMapHandle 8976 -prefsLen 26795 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eda52076-04a6-4806-b7ae-a0da571dc4c9} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 8964 110c7949858 utility
                                        3⤵
                                          PID:1948
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.17.1855343261\663382790" -childID 14 -isForBrowser -prefsHandle 9036 -prefMapHandle 9668 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e3d16fd-1c4c-4aa1-9931-866f5d81a513} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 5228 110c4dcb558 tab
                                          3⤵
                                            PID:4580
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.18.1285229568\462011077" -childID 15 -isForBrowser -prefsHandle 9764 -prefMapHandle 9760 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c7e00a0-6ed6-4240-b196-bd89ac92fe38} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 9320 110c6810058 tab
                                            3⤵
                                              PID:2984
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.19.1976157023\85722970" -childID 16 -isForBrowser -prefsHandle 9724 -prefMapHandle 9752 -prefsLen 26795 -prefMapSize 233444 -jsInitHandle 1252 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd11a12a-f722-4785-8a98-d700f64bd65e} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 9728 110c785ae58 tab
                                              3⤵
                                                PID:4064
                                              • C:\Users\Admin\Downloads\SKlauncher-3.2.exe
                                                "C:\Users\Admin\Downloads\SKlauncher-3.2.exe"
                                                3⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4776
                                                • \??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
                                                  "c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
                                                  4⤵
                                                    PID:4572
                                                    • C:\Windows\system32\icacls.exe
                                                      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
                                                      5⤵
                                                      • Modifies file permissions
                                                      PID:2744
                                                  • \??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
                                                    "c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
                                                    4⤵
                                                      PID:332
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
                                                      4⤵
                                                        PID:2652
                                                      • C:\Windows\SYSTEM32\rundll32.exe
                                                        rundll32.exe url.dll,FileProtocolHandler https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
                                                        4⤵
                                                        • Checks computer location settings
                                                        PID:5900
                                                      • C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
                                                        C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe i4j1321171856815587400.tmp
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:3040
                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                  1⤵
                                                  • Drops file in Windows directory
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:6008
                                                • C:\Windows\system32\browser_broker.exe
                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                  1⤵
                                                  • Modifies Internet Explorer settings
                                                  PID:1468
                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious behavior: MapViewOfSection
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3064
                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                  1⤵
                                                  • Drops file in Windows directory
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5032
                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                  1⤵
                                                  • Drops file in Windows directory
                                                  • Modifies registry class
                                                  PID:5312
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                  1⤵
                                                    PID:4008
                                                  • C:\Users\Admin\Downloads\SKlauncher-3.2.exe
                                                    "C:\Users\Admin\Downloads\SKlauncher-3.2.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3036
                                                    • C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
                                                      C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe i4j5437175824312600673.tmp
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:5696
                                                  • C:\Users\Admin\Downloads\SKlauncher-3.2.exe
                                                    "C:\Users\Admin\Downloads\SKlauncher-3.2.exe"
                                                    1⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5704
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
                                                      2⤵
                                                        PID:5680
                                                      • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\bin\javaw.exe
                                                        C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\bin\javaw.exe -XshowSettings:properties -version
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks processor information in registry
                                                        PID:5008
                                                      • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\minecraft-java-exe\MinecraftJava.exe
                                                        C:\Users\Admin\AppData\Roaming\.minecraft\runtime\minecraft-java-exe\MinecraftJava.exe -Xdiag -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=16M -Djava.net.preferIPv4Stack=true -Xmx4096m -javaagent:C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar -DMcEmu=net.minecraft.client.main.Main -Dlog4j2.formatMsgNoLookups=true -Djava.rmi.server.useCodebaseOnly=true -Dcom.sun.jndi.rmi.object.trustURLCodebase=false -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980 -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980 -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980 -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980 -Dminecraft.launcher.brand=java-minecraft-launcher -Dminecraft.launcher.version=1.6.93 -cp C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.4.10\oshi-core-6.4.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.10.1\gson-2.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\32.1.2-jre\guava-32.1.2-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\73.2\icu4j-73.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\authlib\6.0.54\authlib-6.0.54.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.2.9\brigadier-1.2.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\7.0.14\datafixerupper-7.0.14.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.2.7\logging-1.2.7.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\patchy\2.2.10\patchy-2.2.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.17.9\text2speech-1.17.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.16.0\commons-codec-1.16.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.15.1\commons-io-2.15.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.2\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.1.97.Final\netty-buffer-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec\4.1.97.Final\netty-codec-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.1.97.Final\netty-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.1.97.Final\netty-handler-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.1.97.Final\netty-resolver-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.1.97.Final\netty-transport-classes-epoll-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.1.97.Final\netty-transport-native-unix-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.1.97.Final\netty-transport-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.12\fastutil-8.5.12.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.14.0\jna-platform-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.14.0\jna-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.26.0\commons-compress-1.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.14.0\commons-lang3-3.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpclient\4.5.13\httpclient-4.5.13.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpcore\4.4.16\httpcore-4.4.16.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.22.1\log4j-api-2.22.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.22.1\log4j-core-2.22.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.22.1\log4j-slf4j2-impl-2.22.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jcraft\jorbis\0.0.17\jorbis-0.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.5\joml-1.10.5.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lz4\lz4-java\1.8.0\lz4-java-1.8.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.9\slf4j-api-2.0.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6.jar net.minecraft.client.main.Main --username aidswalking --version 1.20.6 --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 16 --uuid 2fdd2deb1aac362294e5f7983ce027d1 --accessToken 8cb5ad04f9f04b2abcbe3775a0ca1aee --clientId 0 --xuid 0 --userType msa --versionType release
                                                        2⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks processor information in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1596
                                                      • C:\Windows\SYSTEM32\rundll32.exe
                                                        rundll32.exe url.dll,FileProtocolHandler https://discord.gg/BdCcpDZ
                                                        2⤵
                                                        • Checks computer location settings
                                                        PID:2980
                                                      • C:\Users\Admin\AppData\Roaming\.minecraft\runtime\minecraft-java-exe\MinecraftJava.exe
                                                        C:\Users\Admin\AppData\Roaming\.minecraft\runtime\minecraft-java-exe\MinecraftJava.exe -Xdiag -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=16M -Djava.net.preferIPv4Stack=true -Xmx4096m -javaagent:C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar -DMcEmu=net.minecraft.client.main.Main -Dlog4j2.formatMsgNoLookups=true -Djava.rmi.server.useCodebaseOnly=true -Dcom.sun.jndi.rmi.object.trustURLCodebase=false -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1304970597250 -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1304970597250 -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1304970597250 -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1304970597250 -Dminecraft.launcher.brand=java-minecraft-launcher -Dminecraft.launcher.version=1.6.93 -cp C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.4.10\oshi-core-6.4.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.10.1\gson-2.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.1\failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\32.1.2-jre\guava-32.1.2-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\73.2\icu4j-73.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\authlib\6.0.54\authlib-6.0.54.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.2.9\brigadier-1.2.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\7.0.14\datafixerupper-7.0.14.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.2.7\logging-1.2.7.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\patchy\2.2.10\patchy-2.2.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.17.9\text2speech-1.17.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.16.0\commons-codec-1.16.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.15.1\commons-io-2.15.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.2\commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.1.97.Final\netty-buffer-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec\4.1.97.Final\netty-codec-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.1.97.Final\netty-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.1.97.Final\netty-handler-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.1.97.Final\netty-resolver-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.1.97.Final\netty-transport-classes-epoll-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.1.97.Final\netty-transport-native-unix-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.1.97.Final\netty-transport-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.12\fastutil-8.5.12.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.14.0\jna-platform-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.14.0\jna-5.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.26.0\commons-compress-1.26.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.14.0\commons-lang3-3.14.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpclient\4.5.13\httpclient-4.5.13.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpcore\4.4.16\httpcore-4.4.16.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.22.1\log4j-api-2.22.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.22.1\log4j-core-2.22.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.22.1\log4j-slf4j2-impl-2.22.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jcraft\jorbis\0.0.17\jorbis-0.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.5\joml-1.10.5.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lz4\lz4-java\1.8.0\lz4-java-1.8.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.9\slf4j-api-2.0.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6.jar net.minecraft.client.main.Main --username aidswalking --version 1.20.6 --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 16 --uuid 2fdd2deb1aac362294e5f7983ce027d1 --accessToken 8cb5ad04f9f04b2abcbe3775a0ca1aee --clientId 0 --xuid 0 --userType msa --versionType release
                                                        2⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks processor information in registry
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:8792
                                                      • C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
                                                        C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe i4j6596417278842007051.tmp
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:10080
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                      1⤵
                                                        PID:912
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                          2⤵
                                                          • Checks processor information in registry
                                                          • NTFS ADS
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3384
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.0.310734679\261061867" -parentBuildID 20221007134813 -prefsHandle 1552 -prefMapHandle 1544 -prefsLen 21163 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c42c6795-e115-46eb-9234-a269b21a4725} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 1644 228d4dea658 gpu
                                                            3⤵
                                                              PID:5692
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.1.999463985\584035123" -parentBuildID 20221007134813 -prefsHandle 1984 -prefMapHandle 1980 -prefsLen 21208 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1bbd1ec-4e26-4956-9f7e-3caad0320ca9} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 2016 228c9edeb58 socket
                                                              3⤵
                                                              • Checks processor information in registry
                                                              PID:5036
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.2.644084541\1739429455" -childID 1 -isForBrowser -prefsHandle 2712 -prefMapHandle 2588 -prefsLen 21669 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c82a400-6680-4730-8df2-a543b93e6a01} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 2744 228d894a858 tab
                                                              3⤵
                                                                PID:5328
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.3.547506423\1670157360" -childID 2 -isForBrowser -prefsHandle 3292 -prefMapHandle 3288 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b00cd98e-c7ec-46ff-858f-1e53cf9c285b} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 3300 228c9e2db58 tab
                                                                3⤵
                                                                  PID:4608
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.4.1609226245\429034330" -childID 3 -isForBrowser -prefsHandle 4260 -prefMapHandle 3068 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5d9eb0e-006a-4a86-92c4-a086b857ada0} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4272 228d9a68b58 tab
                                                                  3⤵
                                                                    PID:4732
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.5.1164091640\762926058" -childID 4 -isForBrowser -prefsHandle 4616 -prefMapHandle 4604 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e23c6852-a27e-441d-91ac-7f4c7d84ee0e} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4628 228db55ab58 tab
                                                                    3⤵
                                                                      PID:4424
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.6.331032107\10059452" -childID 5 -isForBrowser -prefsHandle 4584 -prefMapHandle 4484 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2dd9139a-b1d4-4001-8a2a-7080867da6b0} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4796 228c9e61658 tab
                                                                      3⤵
                                                                        PID:6136
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.7.1947744249\1925958596" -childID 6 -isForBrowser -prefsHandle 4076 -prefMapHandle 4952 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e37be63a-f43a-4332-8033-cc5ed3756876} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4968 228dbfc8558 tab
                                                                        3⤵
                                                                          PID:3884
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.8.181608869\1441843822" -childID 7 -isForBrowser -prefsHandle 4484 -prefMapHandle 4776 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51b4bbcf-75ab-4f08-a7ea-f4d3c84a2734} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4368 228dbfc8858 tab
                                                                          3⤵
                                                                            PID:3252
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.9.430830265\1510079521" -childID 8 -isForBrowser -prefsHandle 5152 -prefMapHandle 4360 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {982d0d4e-6f0e-4d97-986e-54be2f9dd784} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 5320 228d500f558 tab
                                                                            3⤵
                                                                              PID:4604
                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.10.850578388\1594658401" -childID 9 -isForBrowser -prefsHandle 4808 -prefMapHandle 4604 -prefsLen 26847 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20078405-df0f-4577-908b-2920fc9cf05d} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4888 228c9e66b58 tab
                                                                              3⤵
                                                                                PID:4256
                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.11.92302279\621752347" -childID 10 -isForBrowser -prefsHandle 5644 -prefMapHandle 5752 -prefsLen 26899 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85b15e4e-90a0-4e8c-a3ad-74923f90b1c6} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4740 228de136858 tab
                                                                                3⤵
                                                                                  PID:2232
                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.12.1762295337\1763708352" -childID 11 -isForBrowser -prefsHandle 6676 -prefMapHandle 6680 -prefsLen 27278 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {644539db-f181-441f-973f-3f8a23d9ec64} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 6688 228d9944058 tab
                                                                                  3⤵
                                                                                    PID:2372
                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.13.1448508076\1789163842" -parentBuildID 20221007134813 -prefsHandle 5912 -prefMapHandle 9780 -prefsLen 27549 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {721358c6-c7e8-4d69-8833-9be1d25a3add} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 5940 228dcdae058 rdd
                                                                                    3⤵
                                                                                      PID:3720
                                                                                    • C:\Program Files\Mozilla Firefox\plugin-container.exe
                                                                                      "C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel="3384.14.1821759852\1634228517" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0" -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb19ae84-9c79-4686-91b1-07933724d733} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 9796 228de11a258 gmplugin
                                                                                      3⤵
                                                                                      • Loads dropped DLL
                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                      PID:4724
                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.15.2097297651\2122868500" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9376 -prefMapHandle 9380 -prefsLen 27592 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb2a4b1-dac3-44a4-8177-ca9a193fd466} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 9368 228dbfc7f58 utility
                                                                                      3⤵
                                                                                        PID:2120
                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.16.966661437\2128033485" -childID 12 -isForBrowser -prefsHandle 9732 -prefMapHandle 5468 -prefsLen 27592 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {09ba4202-d712-477a-9aac-040b8cc9ae08} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 9180 228d5f36458 tab
                                                                                        3⤵
                                                                                          PID:3916
                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.17.444572219\2089001540" -childID 13 -isForBrowser -prefsHandle 5668 -prefMapHandle 4856 -prefsLen 27592 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {880e36f0-8b8a-4273-b574-3c9fb1a49901} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 4712 228dd51a658 tab
                                                                                          3⤵
                                                                                            PID:3192
                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.18.572836789\1815724653" -childID 14 -isForBrowser -prefsHandle 4804 -prefMapHandle 4280 -prefsLen 27592 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48fdae18-0929-44ba-94d8-ff5055eaa871} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 5148 228ddc5ad58 tab
                                                                                            3⤵
                                                                                              PID:1968
                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.19.1949508474\1485909952" -childID 15 -isForBrowser -prefsHandle 9328 -prefMapHandle 4728 -prefsLen 27592 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8006380-fd52-4426-abbc-4abeb8625e07} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 2700 228d7989958 tab
                                                                                              3⤵
                                                                                                PID:1956
                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3384.20.1253596689\1815879573" -childID 16 -isForBrowser -prefsHandle 8932 -prefMapHandle 8924 -prefsLen 27592 -prefMapSize 233583 -jsInitHandle 1184 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2e9f78c-fa70-4594-8da6-135708d49844} 3384 "\\.\pipe\gecko-crash-server-pipe.3384" 6568 228dcdace58 tab
                                                                                                3⤵
                                                                                                  PID:3608
                                                                                                • C:\Users\Admin\Downloads\SpotifySetup.exe
                                                                                                  "C:\Users\Admin\Downloads\SpotifySetup.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4824
                                                                                                  • C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
                                                                                                    SpWebInst0.exe /webinstall
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1708
                                                                                                    • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                      Spotify.exe
                                                                                                      5⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:6440
                                                                                            • C:\Windows\System32\SystemSettingsBroker.exe
                                                                                              C:\Windows\System32\SystemSettingsBroker.exe -Embedding
                                                                                              1⤵
                                                                                                PID:308
                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
                                                                                                1⤵
                                                                                                  PID:4008
                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                  c:\windows\system32\svchost.exe -k localservice -s SstpSvc
                                                                                                  1⤵
                                                                                                    PID:3016
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                    1⤵
                                                                                                    • Checks SCSI registry key(s)
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:2024
                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                    1⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2596
                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                                                                                                    1⤵
                                                                                                      PID:5324
                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                                                                                                      1⤵
                                                                                                        PID:6292
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                        1⤵
                                                                                                          PID:6468
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                            2⤵
                                                                                                            • Checks processor information in registry
                                                                                                            • NTFS ADS
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:6488
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.0.126913019\354562248" -parentBuildID 20221007134813 -prefsHandle 1584 -prefMapHandle 1576 -prefsLen 21530 -prefMapSize 233967 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0fd53f0-ac14-4e97-892d-05c1b1719b99} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 1664 24819dfd258 gpu
                                                                                                              3⤵
                                                                                                                PID:6604
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.1.75264054\35064039" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21575 -prefMapSize 233967 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8fac820-7d65-48c7-a5a1-fb5f1021b5cb} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 2004 24819a38b58 socket
                                                                                                                3⤵
                                                                                                                • Checks processor information in registry
                                                                                                                PID:6312
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.2.1828580436\1153027785" -childID 1 -isForBrowser -prefsHandle 2680 -prefMapHandle 2676 -prefsLen 22036 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a025ec0a-04c0-473f-af60-0106bbdcaa2e} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 2692 2481da95f58 tab
                                                                                                                3⤵
                                                                                                                  PID:6836
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.3.1619355321\77165057" -childID 2 -isForBrowser -prefsHandle 3320 -prefMapHandle 3332 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25c98c3a-bbb6-4dc7-b458-2e6a6e41bcf2} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 3340 2481eaf1358 tab
                                                                                                                  3⤵
                                                                                                                    PID:6624
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.4.2083619640\1980051544" -childID 3 -isForBrowser -prefsHandle 3752 -prefMapHandle 3748 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {127d64ef-523a-4a3e-a60c-cead13d73215} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 3764 2481f577b58 tab
                                                                                                                    3⤵
                                                                                                                      PID:3904
                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.5.2026837024\1053859198" -childID 4 -isForBrowser -prefsHandle 4676 -prefMapHandle 4672 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1bbfaed-7f08-4057-9869-0700ad381ced} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 4656 248203a0558 tab
                                                                                                                      3⤵
                                                                                                                        PID:300
                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.6.1699818969\1031350807" -childID 5 -isForBrowser -prefsHandle 4856 -prefMapHandle 4864 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d577b92-2589-4549-9ceb-dc964d4b2fca} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 4976 24820f3f758 tab
                                                                                                                        3⤵
                                                                                                                          PID:5688
                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.7.1816067351\775385385" -childID 6 -isForBrowser -prefsHandle 5112 -prefMapHandle 5116 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47b3398d-1a5f-4ce0-8bd7-5e5f36b0e6ea} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 4996 24820f81058 tab
                                                                                                                          3⤵
                                                                                                                            PID:4948
                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.8.106995842\1026413713" -childID 7 -isForBrowser -prefsHandle 5308 -prefMapHandle 5312 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d0ae3f2-b839-4c1f-b51e-cccb1a7b6c2a} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 5392 24821074f58 tab
                                                                                                                            3⤵
                                                                                                                              PID:1188
                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.9.69263752\298070589" -childID 8 -isForBrowser -prefsHandle 5420 -prefMapHandle 5552 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27e260fe-1f61-43ce-b2a2-7330da89531e} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 5616 24820fb7b58 tab
                                                                                                                              3⤵
                                                                                                                                PID:5328
                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.10.915848417\1108271500" -childID 9 -isForBrowser -prefsHandle 5860 -prefMapHandle 5812 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb184e33-a1c0-48ad-899c-6fa5cafaa3d0} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 5292 24822485258 tab
                                                                                                                                3⤵
                                                                                                                                  PID:332
                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.11.227735943\385685535" -childID 10 -isForBrowser -prefsHandle 6056 -prefMapHandle 5392 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b55fe9c-bd5c-47f6-818e-e398927435f7} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 5276 24822d7d158 tab
                                                                                                                                  3⤵
                                                                                                                                    PID:5244
                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6488.12.512288319\1136000791" -childID 11 -isForBrowser -prefsHandle 4364 -prefMapHandle 5780 -prefsLen 27214 -prefMapSize 233967 -jsInitHandle 1240 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dedd343a-dd15-45c3-bc76-74caa1003074} 6488 "\\.\pipe\gecko-crash-server-pipe.6488" 4360 2482247a858 tab
                                                                                                                                    3⤵
                                                                                                                                      PID:3620
                                                                                                                                    • C:\Users\Admin\Downloads\jre-8u411-windows-x64.exe
                                                                                                                                      "C:\Users\Admin\Downloads\jre-8u411-windows-x64.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:5496
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jds241363312.tmp\jre-8u411-windows-x64.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\jds241363312.tmp\jre-8u411-windows-x64.exe"
                                                                                                                                        4⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:4132
                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:6328
                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                  PID:648
                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                  1⤵
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:6676
                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Modifies registry class
                                                                                                                                  PID:5308
                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:6380
                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                  1⤵
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1580
                                                                                                                                • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                  C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                  1⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:4452
                                                                                                                                  • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                    "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                    2⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:5640
                                                                                                                                  • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                    "C:\Windows\system32\SearchFilterHost.exe" 0 688 692 700 8192 696
                                                                                                                                    2⤵
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    PID:1988
                                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x340
                                                                                                                                  1⤵
                                                                                                                                    PID:6632
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"
                                                                                                                                    1⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:10160

                                                                                                                                  Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        3903daac9bc4a3b7.timestamp
                                                                                                                                        • Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
                                                                                                                                        • Size 46B
                                                                                                                                        • SHA256 afa43775b79cce5bb2a5aa79f349587c998d4d1d42d8d806f4c1ac71c4640300
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        10906
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\10906
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 85801a6d046f7d9b157efec4ef2b8eb515d46fa44eb6a9a95395841a25bc3467
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        11753
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\11753
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 f652fa5add11af08d6a113c5e4a2f71e06cc8b713643ce7cace82e69555f3f92
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        12016
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\12016
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 99f8133f96c9de9be341475c55ae4fa8607fc6265d3e0c5e2fdb02602dab0fcc
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        12175
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\12175
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 40006997f2f0ebb5def319d5933d848db934e504d98cdfe1687e834017b959d7
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        13347
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\13347
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 315c5ebfa93653b18923afd8d9b02b261bc8f8c13db0ae1573bb00f93829ba95
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        14128
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\14128
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 22c765ee02c1590ff2df3de8251c78197854018f005d78958b5d71d619cd277a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        15361
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\15361
                                                                                                                                        • Size 23KB
                                                                                                                                        • SHA256 fe455341b59cf8da8258d5842e98581776f00a7bfedbf468797c6a6247c59bf3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        1586
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\1586
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 b6bef9667aee810f35d369920a7227e19daa02e749b4790f6a5b7d7a9937ad7d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        16323
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\16323
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 3b211107ece18a679837931460ae76382bbebd02b051af1f203d1a44c5bd1594
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        17224
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\17224
                                                                                                                                        • Size 21KB
                                                                                                                                        • SHA256 6ac00e5f6f24063e496668813a8dcaa4090d20454af8ead2cf36d454102132c3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        17239
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\17239
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 9bacac22c451a0e087c04849eb96751b2fa7a409ae3616f3dca8f84108868698
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        17645
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\17645
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 65805385536c24490c9b8761f9a0c231c8a903bc26375acdf438b5ec5c546976
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        18217
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\18217
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 26c0e494aef34738b89bef9f4208a2f32ab9871917de429bb5088474d3610fb4
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        18990
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\18990
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 456ae5a6e3da6af7512ad1af90ed0b674c6be16435d2a600389cf9b47708d58a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        19267
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\19267
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 439bf8c5df4f6c7d645a94040e8de2b889aae90f978ecb6a7fc752f567105374
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        20435
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\20435
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 98be9e9c2405edc9beb6be33de5e4b193559f34d7da89e6220290efa74faf097
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        20497
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\20497
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 c74653d90a54e8243886352948b5a87440c496cf3e0ac95a04702cd2903e09b9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        21878
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\21878
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 63dbf530c2d1a86124d403b1d5ccc5e98375bc4c89b567a7135c41b861fe2703
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        21925
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\21925
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 8831eb6aad16646f748fc34cfc83de885d27199a3331c3d24e5cfae3dc258b0f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        22532
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\22532
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 aaaf9e7c6810716482a3b9fd4445ee84f8136fb5571e1eb8442b14ce10e2c186
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        22942
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\22942
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 a5cc48cc81c900f6b0652efd3c11408c38c714fe0097a64b712c9984154d9676
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        24262
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\24262
                                                                                                                                        • Size 14KB
                                                                                                                                        • SHA256 668a2d991915f8789c212dc10f9f237e585f947c5d8fc888f6ca8753039578ab
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        24928
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\24928
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 cf24ce9c5739ff52ba7adbf615a711e36c464498382af1f0641da49bd03980c4
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        25191
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\25191
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 0a57dff807b166a5c6531f1986e6566a5826cec23122a1fc9e37c6c098b0e569
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        25798
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\25798
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 3ed448329bbb48a288c70a604784fbace4d8156dc93722fe77c654eccf83dfb9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        26207
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\26207
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 1ea7523ab1723097d2748e5974b2d422d047a2ff3bf8054853b594985d2daf49
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        28346
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\28346
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 506d0b2fe1bc6bd6e84b88bed532de690cae6bf6c90ffb99f0ebd91c2c001c26
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        3260
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\3260
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 e4eaf957a70868c5c838a0a002aa606ce5874788f9289debb019464fa23448b1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        32763
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\32763
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 6c566778a0eeb42c4c724f9423f32b12da38de33263749e8d8204330ae85ed79
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        9884
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\doomed\9884
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 b7b21609c56ee3f6b6e915f6550ada97d370a8eee8360fcbea8b97533b26c27d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        0F6E48FC2FE3BA07CF39A943382347AA9FC8C2FC
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\0F6E48FC2FE3BA07CF39A943382347AA9FC8C2FC
                                                                                                                                        • Size 60KB
                                                                                                                                        • SHA256 0c3cdd420c3efeb28c4f0dd9eb445c39908fadcff29bf5d345ee5f78ff0e99a6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        10C0543199997E1F7BC198EDED66D97B334F0C39
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\10C0543199997E1F7BC198EDED66D97B334F0C39
                                                                                                                                        • Size 200KB
                                                                                                                                        • SHA256 d9ec5793a26ea9db4881e24dee0acc440bd6ef7c6c29d9b920ad1004394b0214
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        23497B1A0ED28AAE2C6D515EA7BD9531C3020BF0
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\23497B1A0ED28AAE2C6D515EA7BD9531C3020BF0
                                                                                                                                        • Size 210KB
                                                                                                                                        • SHA256 cdfeab4f8465668bb5f82653087fbe3e56b55588cb44092edffa907d629c5a92
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        25964F52691AED972ED9651DC62D2ED649D0CA04
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\25964F52691AED972ED9651DC62D2ED649D0CA04
                                                                                                                                        • Size 74KB
                                                                                                                                        • SHA256 3abf96cbdb0a7ecd910658adb8de8db79623ed44c4f49a82d836e37296bfb3d0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        2642B139127293682A334A3B94AFED2E56EF6902
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\2642B139127293682A334A3B94AFED2E56EF6902
                                                                                                                                        • Size 17KB
                                                                                                                                        • SHA256 761be992cfb1e4bb91576ae3991485946c4880a397dad649757bbf9b4960449e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        38080459652B535AD0DE543435FBA672A01C1BA2
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\38080459652B535AD0DE543435FBA672A01C1BA2
                                                                                                                                        • Size 18KB
                                                                                                                                        • SHA256 b09af8e6df0d1e16bc5436009a0b1728eaa0068e495bf3ad41027de6675c71b9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        5D725DA1DD35E8A5C0B1026F1D46210CD974636B
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\5D725DA1DD35E8A5C0B1026F1D46210CD974636B
                                                                                                                                        • Size 136KB
                                                                                                                                        • SHA256 ab927615d54bfcccbd6bc30de6be6d8a1dc43941caa8a6c3ee7fe4c48fec45de
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        6D89348819C8881868053197CA0754F36784BF5F
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                                                                                                                                        • Size 11KB
                                                                                                                                        • SHA256 7102ead620661e31d3a7ff430693d21ddc2236e4a2ad19bc5ed8da4bfb390760
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        8FE6BB5B069E32193FA90551D0CABC9D6A7D8B08
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\8FE6BB5B069E32193FA90551D0CABC9D6A7D8B08
                                                                                                                                        • Size 955KB
                                                                                                                                        • SHA256 a3046d6a1126064fd36b4b40320216f9db0368fbb5c90870e74cc880acba3b55
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        A9820D3AA01082CAD0464F5D7B7ACC7020B5827A
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A9820D3AA01082CAD0464F5D7B7ACC7020B5827A
                                                                                                                                        • Size 121KB
                                                                                                                                        • SHA256 8e8a791b5e513aef213a99d184b1f3bfa96ef111925dbcafc2690e2643b4d942
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        A9AF614317B357EF73559D5B7C5EFB6999CD6B5B
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\A9AF614317B357EF73559D5B7C5EFB6999CD6B5B
                                                                                                                                        • Size 4.7MB
                                                                                                                                        • SHA256 6b9fec390d04e7687376d3add5b3f8f9a8afb65ae5174eafa463b5915cb57426
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C
                                                                                                                                        • Size 368B
                                                                                                                                        • SHA256 3ed17f03c33fb305c22297ac40bfd01e55e1fb908dc57e51f4733a8705f69ba0
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        FD8B5A19DF57620BA56D7418AA339A3D779BDF33
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\FD8B5A19DF57620BA56D7418AA339A3D779BDF33
                                                                                                                                        • Size 25KB
                                                                                                                                        • SHA256 e1600fb5386ca419986c8d1eca99b69d01b3c9768bc8c0d89788a9b65c81a2a0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        index
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\index
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 e2ab6aa16223fecca9473199d1f11a24ad58291c43e451fbf7f42bcc2c1dbc3d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        index.log
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\index.log
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 7031c476e4343fc4f2725bc100ef1f1d2ef25fbac01cb68f06fc33caa046cb78
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        n8k18eEP3XVV5fxtpoQkUw==.ico
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\jumpListCache\n8k18eEP3XVV5fxtpoQkUw==.ico
                                                                                                                                        • Size 729B
                                                                                                                                        • SHA256 316cfafdd8b1bc8579f8dd241a1072c87873cdb11ab6b1e0f05e7d71369a6b19
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        urlCache.bin
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\startupCache\urlCache.bin
                                                                                                                                        • Size 2KB
                                                                                                                                        • SHA256 b501582c8cb4a5f568df38be335c9b3d46f975562bd2785511861a2fd6445d48
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        login.live[1].xml
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\HRBX3BZ1\login.live[1].xml
                                                                                                                                        • Size 13B
                                                                                                                                        • SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        www.msn[1].xml
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\LU5KO5ZN\www.msn[1].xml
                                                                                                                                        • Size 482B
                                                                                                                                        • SHA256 19e72630d126e051f4f40f5fa2ecc338bd81db81a7ad2b2ef9ac10f23bb292b5
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        favicon[1].ico
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RML28J1S\favicon[1].ico
                                                                                                                                        • Size 23KB
                                                                                                                                        • SHA256 128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        favicon[1].ico
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\SGCG3FET\favicon[1].ico
                                                                                                                                        • Size 16KB
                                                                                                                                        • SHA256 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        edb.log
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\LogFiles\edb.log
                                                                                                                                        • Size 512KB
                                                                                                                                        • SHA256 18fa8313253ea5b9274dd8b3c7aa161defde8607cf6b3e728b26123c09658fb4
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        imagestore.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\utymd3p\imagestore.dat
                                                                                                                                        • Size 42KB
                                                                                                                                        • SHA256 c95c7174bc6ae1f87b895dc18013e19637c063ceea7c20223ce3802777989106
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        imagestore.dat
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\utymd3p\imagestore.dat
                                                                                                                                        • Size 26KB
                                                                                                                                        • SHA256 d43626d8df8991aa19a537bee3602d3c0783ef8febaadb306131fd8ecf806231
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        ~DFF7441BD4DF81C75E.TMP
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFF7441BD4DF81C75E.TMP
                                                                                                                                        • Size 16KB
                                                                                                                                        • SHA256 77ee781f711b1e46f05cc1ad6da40d5b14196e3d91e21e29d78db724fffde8bb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF4052844772325346394.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF4052844772325346394.tmp
                                                                                                                                        • Size 405KB
                                                                                                                                        • SHA256 0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF4597361929477131352.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF4597361929477131352.tmp
                                                                                                                                        • Size 403KB
                                                                                                                                        • SHA256 d054d998ae12be33820b100e0ed3923d513fa5c79c6d4e7ca1953afeb262ea9b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF4768154438635635737.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF4768154438635635737.tmp
                                                                                                                                        • Size 410KB
                                                                                                                                        • SHA256 5e606f805a71432d4875de7dab737bf9dea1187090f0a5190da9b1bbab09f57c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF4784780067006700818.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF4784780067006700818.tmp
                                                                                                                                        • Size 393KB
                                                                                                                                        • SHA256 4c392dcc8ad916f0f9df7559ab5563b01dd94f9f3b2db34617fe392e00060339
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF4947268008213846848.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF4947268008213846848.tmp
                                                                                                                                        • Size 397KB
                                                                                                                                        • SHA256 64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF5712007104081739005.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF5712007104081739005.tmp
                                                                                                                                        • Size 412KB
                                                                                                                                        • SHA256 d549110689cdde0821ca2c7148f7b47a097166b4169786a4a9ede675f5ce87f3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF5933899926327751379.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF5933899926327751379.tmp
                                                                                                                                        • Size 398KB
                                                                                                                                        • SHA256 1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF627935389043608021.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF627935389043608021.tmp
                                                                                                                                        • Size 401KB
                                                                                                                                        • SHA256 1bda81124d6ae26ed16a7201e2bd93766af5a3b14faf79eea14d191ebbd41146
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF7449354641279939100.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF7449354641279939100.tmp
                                                                                                                                        • Size 404KB
                                                                                                                                        • SHA256 6bdebeb76083e187c7ae59420bfc24e851edb572e1a8d97c1c37b7b2dc26148c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF7542973517544719658.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF7542973517544719658.tmp
                                                                                                                                        • Size 405KB
                                                                                                                                        • SHA256 fe3714926082ac5764327e3b67ae52cb6f0cf6b8c4221c064a6cacf821079414
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF7624541201658579969.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF7624541201658579969.tmp
                                                                                                                                        • Size 407KB
                                                                                                                                        • SHA256 0d34f9588400a586b774be97e66ae8c076a8807b8455df0587b39d2a4a1a3b42
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        +JXF8602201351783414257.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\+JXF8602201351783414257.tmp
                                                                                                                                        • Size 400KB
                                                                                                                                        • SHA256 5fc09af94a447fae6f82c00f15dfaef9eae7c560e6cbe46d3e84524019a574aa
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        SKL_TempStyleClass5840427437242871556.css
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SKL_TempStyleClass5840427437242871556.css
                                                                                                                                        • Size 266B
                                                                                                                                        • SHA256 e3c1fd97b905ff659aafd4220812d1747cd30bf83c9a960aca3a0b2399872722
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        SKlauncher-3.2.jar
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\e4jECA5.tmp_dir1714790833\SKlauncher-3.2.jar
                                                                                                                                        • Size 1.1MB
                                                                                                                                        • SHA256 f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        exe4jlib.jar
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\e4jECA5.tmp_dir1714790833\exe4jlib.jar
                                                                                                                                        • Size 62KB
                                                                                                                                        • SHA256 8a416dab7b3028f3e79b41521b65432ab2d25dec9f85e220ade0157badc0dd41
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        i4j1321171856815587400.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\i4j1321171856815587400.tmp
                                                                                                                                        • Size 862B
                                                                                                                                        • SHA256 51ab9d24f1e8deeb397ce4586dbc771841d19ae6d80dc809e120602a6df424c4
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        i4j5437175824312600673.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\i4j5437175824312600673.tmp
                                                                                                                                        • Size 862B
                                                                                                                                        • SHA256 cf96f15ea83c1c1a2bd6f971aae59b0f7dac0bd02d40133950b49ac8e19f4b48
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        i4jdel0.exe
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\i4jdel0.exe
                                                                                                                                        • Size 93KB
                                                                                                                                        • SHA256 e48ef14933f4eb6071497a5311ca0ac6e115f7a0d57a60e519296f8fd42ad4fe
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        imageio1397700649927498963.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\imageio1397700649927498963.tmp
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 face76c9c4fad9476a1d80483d41772c805808a1383012b1c22065e30d32ede6
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        imageio8750685964070628311.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\imageio8750685964070628311.tmp
                                                                                                                                        • Size 12KB
                                                                                                                                        • SHA256 90f1e2bcc7b6c2e9b5acbf3211ecb0b58f9e36b4f3db56acfc07f2a3577b644a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        jusched.log
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                                                                                        • Size 154KB
                                                                                                                                        • SHA256 0f7cdcc92812368bebc2a9861a004773e5fafcb9e495830fe5acb3669a7d622f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        tmpaddon-1
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                                                                                        • Size 442KB
                                                                                                                                        • SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        tmpaddon-2
                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-2
                                                                                                                                        • Size 8.0MB
                                                                                                                                        • SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        16.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\assets\indexes\16.json
                                                                                                                                        • Size 434KB
                                                                                                                                        • SHA256 65c4941404715a1090a87d5e799c70b0e5b51be9971d3db0cec2b687de2350bd
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        launcher_profiles.json.bak
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\launcher_profiles.json.bak
                                                                                                                                        • Size 559B
                                                                                                                                        • SHA256 a3dab7338b766b3b4d8196a459359ff52ea3dc63771ae333969b7119db578dc8
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        ADDITIONAL_LICENSE_INFO
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\legal\jdk.internal.vm.ci\ADDITIONAL_LICENSE_INFO
                                                                                                                                        • Size 48B
                                                                                                                                        • SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        ASSEMBLY_EXCEPTION
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\legal\jdk.naming.rmi\ASSEMBLY_EXCEPTION
                                                                                                                                        • Size 43B
                                                                                                                                        • SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        LICENSE
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\legal\jdk.net\LICENSE
                                                                                                                                        • Size 32B
                                                                                                                                        • SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sklauncher-fx.jar
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar
                                                                                                                                        • Size 17.2MB
                                                                                                                                        • SHA256 0e79303169cd0305c364885824b1ee91b15e6ede8b7eae02e808ad4c4c35a36f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        accounts.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher\accounts.json
                                                                                                                                        • Size 409B
                                                                                                                                        • SHA256 7fab60561b867a476c71e51249aaf7ef3452e42dfde01e7cd91220cd112cc666
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sklauncher.vmoptions
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher\sklauncher.vmoptions
                                                                                                                                        • Size 82B
                                                                                                                                        • SHA256 c0ad6503240446061d7da9181b625f149574430135e0d6ab32fb61f176c831fe
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sklauncher_data.bin
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher\sklauncher_data.bin
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 ac45002b2aceb188d5372b9a818329992da039b564a1261e069685c0dba8c674
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        glfw.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980\glfw.dll
                                                                                                                                        • Size 484KB
                                                                                                                                        • SHA256 affa7e54eb0dedce4a5721c327c1a16035edbbd039cd402e08107d6d2d55eb1a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        jemalloc.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980\jemalloc.dll
                                                                                                                                        • Size 389KB
                                                                                                                                        • SHA256 9abf0095066ebab37b78968e11370a8078313e48cb5be8eda01f67623c6a6248
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        lwjgl.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980\lwjgl.dll
                                                                                                                                        • Size 468KB
                                                                                                                                        • SHA256 a39adf52947fafd954c2a86ce031abb8c59825f7ee50337ac8c41e4280abe82d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        lwjgl_tinyfd.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\.minecraft\versions\1.20.6\1.20.6-natives-1099017328980\lwjgl_tinyfd.dll
                                                                                                                                        • Size 246KB
                                                                                                                                        • SHA256 ec7d76e6ef7a99628ef6f8b6e544294b700108c341837779e6e2c01c0bc3da9c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        83aa4cc77f591dfc2374580bbd95f6ba_ebaa0802-254d-4be1-a642-a8a5c0b06224
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4106386276-4127174233-3637007343-1000\83aa4cc77f591dfc2374580bbd95f6ba_ebaa0802-254d-4be1-a642-a8a5c0b06224
                                                                                                                                        • Size 45B
                                                                                                                                        • SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        40371339ad31a7e6.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
                                                                                                                                        • Size 5KB
                                                                                                                                        • SHA256 e8dbad0bc20ee85b96b0dd345f16348c7110fdc7870979fb908ee36b1acabac0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        6824f4a902c78fbd.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 0d0830f0d593df158b36eb356480c1635b01bd8ad9e53bb536e2ea89d2c6404a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        6824f4a902c78fbd.customDestinations-ms
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                        • Size 18KB
                                                                                                                                        • SHA256 7b1091bf034ae7a218f7a90425a88352bc414f57a7770c3683c22308ad92d912
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        AlternateServices.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\AlternateServices.txt
                                                                                                                                        • Size 5KB
                                                                                                                                        • SHA256 2059e05b0282a145812a3861104477f40a30e68c4bc41764282601f6ad6c6c12
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        SiteSecurityServiceState.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\SiteSecurityServiceState.txt
                                                                                                                                        • Size 493B
                                                                                                                                        • SHA256 63723e42e61082c8026af2f47d93c28b60e0569f8083b499f28099ce403eda64
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        cert9.db
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cert9.db
                                                                                                                                        • Size 224KB
                                                                                                                                        • SHA256 e113485262ff51848347e9a15ac38a3421537aa06c7e3060699c82f2ba1417c0
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        cookies.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cookies.sqlite
                                                                                                                                        • Size 512KB
                                                                                                                                        • SHA256 2680e6c3b206f3828c76801471e6ff49d9cccf6deaa93eb57af1ebcc95827731
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        store.json.mozlz4.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\crashes\store.json.mozlz4.tmp
                                                                                                                                        • Size 66B
                                                                                                                                        • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.bin
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                                        • Size 17KB
                                                                                                                                        • SHA256 257dcee5f2ddda380183b364cd8c06f81184dd4544b87756564a3e05ff08b6af
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.bin
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 eb4f4702e7ab9d7d69d40b2087f6ab6dc648125e0f9f1b65b3209be821e0e49d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        data.safe.bin
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                                        • Size 16KB
                                                                                                                                        • SHA256 d97d9c6dc363ce5c517e777cce8126e6e284dc9dd1810b765ebd15b20690f22a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        events
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\events\events
                                                                                                                                        • Size 486B
                                                                                                                                        • SHA256 cf6066120f0fe0e7bd423e05c50e15ac5443b9a8674d8f6554af796bafe41769
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        0cab08d3-af1d-4294-a413-b78f641e77a0
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\0cab08d3-af1d-4294-a413-b78f641e77a0
                                                                                                                                        • Size 734B
                                                                                                                                        • SHA256 27de742a1f901e702dde80af6a86a908af5e6719e0bfc50d0d59d5da82e90134
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        8b6e71d2-6f6e-403d-bdc7-8cbeab97e352
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\8b6e71d2-6f6e-403d-bdc7-8cbeab97e352
                                                                                                                                        • Size 1002B
                                                                                                                                        • SHA256 6dc45e93ff41b36bcce61e3083b773caa2da2a0e3406ef76e97421310a8dfdd9
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        a149d1f5-3d4e-4589-a1c4-b993d26988e8
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\a149d1f5-3d4e-4589-a1c4-b993d26988e8
                                                                                                                                        • Size 768B
                                                                                                                                        • SHA256 0eee2948f74938d90c898a7a9fe6fd139ae29d450f46484a28a7385463080b25
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        d4aa142e-ea0c-43ce-beee-585a4b509048
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\d4aa142e-ea0c-43ce-beee-585a4b509048
                                                                                                                                        • Size 714B
                                                                                                                                        • SHA256 9b2f585055c4d0d75490b6b765104c529b3d846842eed564cb5e93a9695277e0
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        d857d081-98b6-407a-a213-d9de81804e08
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\d857d081-98b6-407a-a213-d9de81804e08
                                                                                                                                        • Size 855B
                                                                                                                                        • SHA256 e2af15a2e422d6b7efc0c6c67843e63e4169c92bb70115ad56f18653a48a3aca
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        dd616d1e-88ae-45e6-a2c1-06971edf59bc
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\dd616d1e-88ae-45e6-a2c1-06971edf59bc
                                                                                                                                        • Size 714B
                                                                                                                                        • SHA256 8481d0f22b917bf9511b164b4f709670abaddc3009a2ca7e967e59924cb800b9
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        ed9ef829-5f3d-4622-8621-8a0a3bd52575
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\ed9ef829-5f3d-4622-8621-8a0a3bd52575
                                                                                                                                        • Size 1010B
                                                                                                                                        • SHA256 c1c9725681b250a73b20cc7b744eff5d30c6eeae38988cc606d48b4efc493561
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        favicons.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\favicons.sqlite
                                                                                                                                        • Size 5.0MB
                                                                                                                                        • SHA256 d53aec18c789f0ac6e87c0a14918190a48d1b91dd83e3af96b553712756115f3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        formhistory.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\formhistory.sqlite
                                                                                                                                        • Size 256KB
                                                                                                                                        • SHA256 e30b8ca951675088a21f75853b689347f38553b435de4530d096ecce2d58a661
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        gmpopenh264.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                                                                                                                        • Size 997KB
                                                                                                                                        • SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        gmpopenh264.info
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                                                                                                                        • Size 116B
                                                                                                                                        • SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        LICENSE.txt
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                                                                                                                        • Size 479B
                                                                                                                                        • SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        manifest.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                                                                                                                        • Size 372B
                                                                                                                                        • SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        widevinecdm.dll
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                                                                                                                        • Size 11.8MB
                                                                                                                                        • SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        widevinecdm.dll.lib
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        widevinecdm.dll.sig
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        permissions.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\permissions.sqlite
                                                                                                                                        • Size 96KB
                                                                                                                                        • SHA256 11a21a2466757240307e382cfb96536f60ba391296f17ac56e9fc77914fd64b1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        places.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\places.sqlite
                                                                                                                                        • Size 5.0MB
                                                                                                                                        • SHA256 290476623db9d4d5cb424626ffa8419692202745dfcbc2bcc64312357a6181ab
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        places.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\places.sqlite
                                                                                                                                        • Size 5.0MB
                                                                                                                                        • SHA256 f792cadc16eacdde791001bcf62ab3010add4a2bdc297e1eeca53f0c5e5b3b34
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 3bfa148d4dff4fcecfb8472491f3ee39f02eb6e038aabe2c65ff00cccb614dd3
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 3a3cf8750b1499ed31cb91ef6026c03c323258e8cc5ed6c87039f8f0b2fb255b
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 36a78df592a303a00bb51565528c3c903edb7546d3d2f4ac44424615de04d690
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 2d89f97df79c1b4801fbffc4d1adf99a10595fdae6758afaa527bf7aca7770d9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 683b7fda4eca43282e719c0e49de04b28a75f8843decf5983a020d80e8678c00
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        prefs-1.js
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
                                                                                                                                        • Size 6KB
                                                                                                                                        • SHA256 f0332f29fe1327764cd1dd331369678bd858c364e625d1883a5c28e16cb0c73c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        protections.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\protections.sqlite
                                                                                                                                        • Size 64KB
                                                                                                                                        • SHA256 02ea9271575c3da7a83e99d3a1c068a4bc6a84d0bbe083a1b5fba7541ade4654
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json
                                                                                                                                        • Size 288B
                                                                                                                                        • SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json
                                                                                                                                        • Size 259B
                                                                                                                                        • SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
                                                                                                                                        • Size 122B
                                                                                                                                        • SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
                                                                                                                                        • Size 53B
                                                                                                                                        • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
                                                                                                                                        • Size 90B
                                                                                                                                        • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
                                                                                                                                        • Size 146B
                                                                                                                                        • SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
                                                                                                                                        • Size 259B
                                                                                                                                        • SHA256 4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionCheckpoints.json.tmp
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionCheckpoints.json.tmp
                                                                                                                                        • Size 193B
                                                                                                                                        • SHA256 ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 1bfadfaa06013526189a06448369ae7d3788e29e2efdb0cb74512f04f1280e70
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 7b6515319a1904ea151e361a85d223a6be64c8adc49334be4f4dcb55722845ec
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 15b14f7b429afab372577d0ba2a92e754f46ba29e446e19d846419db7a56a244
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 cceb3c270c0dd5d72bcc56681f0972e9f49586c5122b00d4ad1d6ee3345fa4fb
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 67365265b71025d972e579bf237f9655014ddf0d2d03018772814e05bc89ceb1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 246cf925828d370cd8e8a8d8672ab8885d9f161c50ac33f68e4921faac96e1f7
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 18KB
                                                                                                                                        • SHA256 e41fbc2c4cba45855a961ccf12c43f19d90d673378affdd18b28c68b5fc4b328
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 055bcb25bae9e180739167c22b9fcd8c669781915043180cb7ca3e3809e7b0ff
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 dc8f6b86614e30097186122410fbdc19f83e22bf82af418588d3b5c5d458c44d
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 14KB
                                                                                                                                        • SHA256 4b4210490f671b66ba9749ad0e84e9e34acec891573df52aadc667d1b595d128
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 7KB
                                                                                                                                        • SHA256 e541b94d2e3b90dcdaa86ef03afe9078c5b91b6f20908dbd2023214f86432666
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 02f72736ffd279a2f66628fda1d6d8142cfe4004b844ca53954c2018ef2f9c15
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 843ae17e793a3a049d154f724b0af28663236c9a88d02f578e77b5cf0cea63ea
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 a9f4123289ecd4bd4706f3444fcb1657aff6fc7bcd17cc5860c02b11991835f1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 10KB
                                                                                                                                        • SHA256 fde6c76f3ea3cbf99b1d16f768af2559b5bd2d71c776889294c921532b795aca
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 1KB
                                                                                                                                        • SHA256 793495438ea4930528976414838f4b0a520adc94c8d5f9c0bdd2cb9db8db7b58
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 18KB
                                                                                                                                        • SHA256 70d5a295002bfec362fd299310d28f3c9fc263d0a6715d3871599ad41971eef6
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 ea214d94312ede710d0447c8be141122b59c0b15eb973d3fde87aa5a0fd5ece3
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 2d0aaa45f3e399f6e9d06c31063b6e8e56f6fec289c8d0f200d1da0c7a21f3dc
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 e97b5ca6ee7e1dafefb40bf961204cacfee5ea9cc5d23ff2c3a79fab61e3eff5
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 5c42d7eff0fd1c720cb040af1fa16489d97bcd0d4f3df6faacb0c4057cd2963a
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 8013ac3dfb0309d52c0c93871a7325baeff9a7bc40a2a1dbf4a35ad798c9ad0f
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 43b603d500c92e84300c1a30c33d4efb281b252b7e476b26af4291a81f278da4
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 b287af7379daedafeac0c8b5ac33ed25b664e89ee7e594ed38695a21083a9526
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 9a4673d1093fb2019673da84988806aeb141fdbe58ea7b5ff490a7ac6f0a6d5c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 7b87d014ecc9fd1bdf3e8d09f63f3ae676bba3ac5dd2984a4f82c349b0895d67
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 4a1241dc5443795bc05c62a34dee2f54ab707a920c61a36df49a6b0092889a67
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        recovery.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                        • Size 9KB
                                                                                                                                        • SHA256 adad95e3e8fbe799d821179ee84ab3eda09d551d2445dbf40ae598bbab8240d2
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        sessionstore.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4
                                                                                                                                        • Size 13KB
                                                                                                                                        • SHA256 0286ccc6c8d5d160833af587b93edb1376b46a8a9a4be889744a6773e0bc3ca1
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        sessionstore.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4
                                                                                                                                        • Size 3KB
                                                                                                                                        • SHA256 308b807ea50c72e520c3eec4bf9f360e75696b8013dc9942175376946073706f
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        sessionstore.jsonlz4
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore.jsonlz4
                                                                                                                                        • Size 8KB
                                                                                                                                        • SHA256 98dec316692a9568907c955beac1352e1432745931c13f6ee218bdfc435d9655
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        storage.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage.sqlite
                                                                                                                                        • Size 4KB
                                                                                                                                        • SHA256 694b5cc8cfe554135252e03132bdca940a13bfb02e0ee205bdcff5ae7537026d
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        {a62b87d6-d776-4a1d-ba6d-d8de18681178}.final
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++open.spotify.com\cache\morgue\120\{a62b87d6-d776-4a1d-ba6d-d8de18681178}.final
                                                                                                                                        • Size 23KB
                                                                                                                                        • SHA256 43648804333d60ba9cc91e77ab8216c723b2fb71f8a75dd4892bbaea53184e19
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        .metadata-v2
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.google.com\.metadata-v2
                                                                                                                                        • Size 62B
                                                                                                                                        • SHA256 89117e18bf7915c54bd8aa2289c5a0cd3f279e3756a9b4b4fc2705a36bd4a21a
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        usage
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.google.com\ls\usage
                                                                                                                                        • Size 12B
                                                                                                                                        • SHA256 89ae79ea8815f86407797af5e46f32547c7920320e427a0b1818a4fd1b82208e
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        .metadata-v2
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Cskmedix.pl%29\.metadata-v2
                                                                                                                                        • Size 176B
                                                                                                                                        • SHA256 debb8dc821a7cb086bb6a09cbc2318bcd5426b7ae4dc1e6307e2723b1038617f
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        usage
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\default\https+++www.google.com^partitionKey=%28https%2Cskmedix.pl%29\ls\usage
                                                                                                                                        • Size 12B
                                                                                                                                        • SHA256 0ef72b88336bf69ce23a2f09cd08268e0eb7ef6ce19e7fd0632c7179a22f7f31
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        1657114595AmcateirvtiSty.sqlite
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
                                                                                                                                        • Size 48KB
                                                                                                                                        • SHA256 0008e107a2485ac77c6e224c6752f58ccbead638db55d383b0666647c79d84c9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        xulstore.json
                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\xulstore.json
                                                                                                                                        • Size 219B
                                                                                                                                        • SHA256 685d07ca85d5bb59d1e21526281281930e499dcdf9553e135f9c441c44593ae3
                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                        Submit Download

                                                                                                                                        SKlauncher-3.2.exe
                                                                                                                                        • Path C:\Users\Admin\Downloads\SKlauncher-3.2.exe
                                                                                                                                        • Size 1.6MB
                                                                                                                                        • SHA256 05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        SKlauncher-3.b9mxBJXV.2.exe.part
                                                                                                                                        • Path C:\Users\Admin\Downloads\SKlauncher-3.b9mxBJXV.2.exe.part
                                                                                                                                        • Size 68KB
                                                                                                                                        • SHA256 cd6ad49081e1244265ef98475218bb843765b72702e2c7635f6a2be6164439c9
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        SpotifySetup.1KNYQARm.exe.part
                                                                                                                                        • Path C:\Users\Admin\Downloads\SpotifySetup.1KNYQARm.exe.part
                                                                                                                                        • Size 152KB
                                                                                                                                        • SHA256 2bf4be1f2ece869159c1f8d5c0a8a4b806e8b9007c1bcf2193a36621f99279e8
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        jre-8u411-windows-x64.D1XWpXur.exe.part
                                                                                                                                        • Path C:\Users\Admin\Downloads\jre-8u411-windows-x64.D1XWpXur.exe.part
                                                                                                                                        • Size 15KB
                                                                                                                                        • SHA256 6eada6e5391930544fdece53aac83be53b9b4b66bb1dd02ec9b39650eb0e7b12
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        flatlaf-windows-x86_64-8927770824600.dll
                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-8927770824600.dll
                                                                                                                                        • Size 22KB
                                                                                                                                        • SHA256 ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        jna8028659467676948691.dll
                                                                                                                                        • Path \Users\Admin\AppData\Local\Temp\jna-63116079\jna8028659467676948691.dll
                                                                                                                                        • Size 248KB
                                                                                                                                        • SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                        Submit Download

                                                                                                                                        memory/332-1033-0x000001CFE0740000-0x000001CFE0741000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4572-1019-0x00000271673F0000-0x00000271673F1000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4572-1001-0x0000027168C10000-0x0000027168E80000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4572-1021-0x0000027168C10000-0x0000027168E80000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1269-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1233-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1265-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1046-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1050-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1083-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1128-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1134-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1173-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1186-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1199-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1268-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1217-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1261-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1232-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1231-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1230-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1228-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1248-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1251-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4776-1254-0x0000000002660000-0x0000000002661000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/4988-0-0x00007FF98A7E0000-0x00007FF98B490000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6440-12827-0x0000000001250000-0x0000000002BAD000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/6440-12728-0x0000000001250000-0x0000000002BAD000-memory.dmp
                                                                                                                                        Download

                                                                                                                                        memory/10160-18824-0x0000000001250000-0x0000000002BAD000-memory.dmp
                                                                                                                                        Download