d5ae7fce68cdbc8f34f9237f63b073b7a20f17ee57c08ae9a02769a4932e8b58

Analysis

max time kernel
949s
max time network
1034s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5.2OUNO6v8hl1K1pCTOnQw.jpg
Size 37KB
Sample240603-nqd53aed22
SHA256 d5ae7fce68cdbc8f34f9237f63b073b7a20f17ee57c08ae9a02769a4932e8b58
MD5 d96006d77f94c4c0a57ee1f46befb3b6
SHA1 0e00182749e56c894c39155be579d29889370eee
SHA512 be19d52b44889a30b01a6a7edda48ad76b8739ac281b6ca10c1138a69911b892ad47aa25098bc127bd2d5b38da9aa0ed48495bbfa47b841232b49ce606aee3db
SSDEEP 768:xBsNCMAGnQIdMYOujvj0IDHtY4k8vXjNfhDMot3r0Ia4D1pR:wEIdMYOujNg8fjNfhoodr0F4Dh
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
179	discord.com
180	discord.com
181	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{DBBE755E-B003-491D-8F1B-9E2257BE95DB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
432	msedge.exe
432	msedge.exe
2336	identity_helper.exe
2336	identity_helper.exe
3192	msedge.exe
3192	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	firefox.exe
Token: SeDebugPrivilege	2876	firefox.exe
Token: SeDebugPrivilege	2876	firefox.exe
Token: SeDebugPrivilege	2876	firefox.exe
Token: SeDebugPrivilege	2876	firefox.exe
Token: 33	1624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1624	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
2876	firefox.exe
2876	firefox.exe
2876	firefox.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2876	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2428 wrote to memory of 2876	2428	firefox.exe	101
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2904	2876	firefox.exe	102
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103
PID 2876 wrote to memory of 2344	2876	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5.2OUNO6v8hl1K1pCTOnQw.jpg
1⤵
PID:1172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.0.154499571\1434091747" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bf62624-b9bb-4b39-ab8c-e70881db1520} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 1852 28a489b6758 gpu
    3⤵
    PID:2904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.1.1957279964\2072071537" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daa49625-fde8-42b8-b81f-9f1ef78c3089} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 2420 28a3bb89658 socket
    3⤵
    - Checks processor information in registry
    PID:2344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.2.1363003310\1612397092" -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 2916 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcfce165-ad41-4a4e-9401-6c98a43a7e76} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 2640 28a4b1f6258 tab
    3⤵
    PID:2596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.3.397330407\1495918471" -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15565036-c948-462e-b54b-db3ba4f933f9} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 3688 28a3bb3e258 tab
    3⤵
    PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.4.738684039\1111173402" -childID 3 -isForBrowser -prefsHandle 5032 -prefMapHandle 5028 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1892b0f-ea5c-4b26-9eba-19dcff308171} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 4916 28a4f6de358 tab
    3⤵
    PID:1976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.5.347203079\558425753" -childID 4 -isForBrowser -prefsHandle 5168 -prefMapHandle 5172 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97613bd1-23fc-4b46-b8a6-8df7ec2eb640} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 5156 28a4f6df558 tab
    3⤵
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.6.1685411991\101192987" -childID 5 -isForBrowser -prefsHandle 5368 -prefMapHandle 5376 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {edceb347-594e-4fff-9800-fa0ccf849a17} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 5356 28a4f6dfb58 tab
    3⤵
    PID:5032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2876.7.1856721425\811234304" -childID 6 -isForBrowser -prefsHandle 5992 -prefMapHandle 5804 -prefsLen 30743 -prefMapSize 235121 -jsInitHandle 1284 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31246a75-7eca-48aa-ba91-7a8971856b31} 2876 "\\.\pipe\gecko-crash-server-pipe.2876" 5972 28a48ea9458 tab
    3⤵
    PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ffaf12746f8,0x7ffaf1274708,0x7ffaf1274718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8031769648724507302,12888072788054034248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x314 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

15c6cf76-33bd-4353-b126-87b07b6ce816.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15c6cf76-33bd-4353-b126-87b07b6ce816.tmp
Size 1KB
SHA256 e6e4fe904143d0a176f290d899ea2f52030e2b1cbbd5ba34e0b14995ab449063
MD5 e9fea452d4226fedc034519f3b8e6e31
SHA1 3b324c2f01ad8ef0659d4bfcd15fe445b2d43b42
SHA512 ff1ef9774d99f5cade1ee7263dfc94ade0c6cddab9d6fb807536b5befd909fb4f3e6757cbcb416f05fb11dc0756f57283aeab2bb8e999a4188da17b8674cfa5b
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 62KB
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
SSDEEP 1536:6+yyTwrwGtdPDZMlQcadLSHdqyjTxJMJwh09KWWXDManYPHc:6byTwrXL7ZoM28wPIawHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 67KB
SHA256 6e273f3491917d37f4dbb6c3f4d3f862cada25c20a36b245ea7c6bd860fb400c
MD5 d2d55f8057f8b03c94a81f3839b348b9
SHA1 37c399584539734ff679e3c66309498c8b2dd4d9
SHA512 7bcdbb9e8d005a532ec12485a9c4b777ddec4aee66333757cdae3f84811099a574e719d45eb4487072d0162fa4654349dd73705a8d1913834535b1a3e2247dc6
SSDEEP 1536:lqJs/v+IjgmmFS4JFXLgXI84enK6kqPc7X0iuw0OO1AiGaB+H9:lx+Ijq44JFXLgY8DnRkqkXGOHhH9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 40KB
SHA256 fe8ffa9f7682f10f96899685ecb9bac43717904b88b54fd49dc0107f77f0096f
MD5 6c8413dbb2b54b0d8d2c44902da2488b
SHA1 d798aaff61a4dcf553c40705a2029497dda61d1a
SHA512 f5ed56a26aaae0093ed55deba827d02df775c1673cf3270a1ec6d5feef3a3c556523d1ef5535da4488f284b8a9ddf67682309748a769f0b39c96f06409030fdc
SSDEEP 768:qldvJILQb69WPhHdA3CT24HeK86pEzUJNLy+ZvwLfwol0DdDaM1H:6v4QbVhHdASTfxbqzUzxndtH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 1.2MB
SHA256 065c1d1d5d643ada11492f0b69c18d437cdef4bd9cc604af593cddbbc7dfbae4
MD5 3c6402ca667d5be25d0cf118502f6f41
SHA1 c57737bb7409d91579569d7cb1f21c8c5925c430
SHA512 ac2fcbc9165343b6046b880623ccfc3ef50e43609f5432e41f477d8ab4142ae76eb82bbb27144f89053ec6196f87249085d7a31df25564c75be9a14ac58db464
SSDEEP 24576:p6Ck623tDOBl7163gjhOT/pCYyoEVaFbC6i7ycsoTGdg3rRnMw:peLJol71hAT/p128buycsoTGdg3t
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d
Size 29KB
SHA256 6160a9f25b0dba39f0325b3268e0c00e2c374fd278fd1e90edc2fa87271b55bd
MD5 07bd004322d7b2832709191bddd0567a
SHA1 9149ed0c2466995a3b6dd5182865a78fd76ec0ea
SHA512 28de08cc0284652a62600ea99583a758e83b8c79e10982a8fb11058bb5bfeac5570ecc51b4c58589e8f1b821645839ea5639dbdea2071bd1af9d0d4145e2d944
SSDEEP 768:4zooTA36ovj7F1xoeCDXUCoy0FjnCNPJxHTaAU:4zFGx/U7mxjyJxHfU
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 657c04e041f15ad967304faabfb7209b6228c89c74fbf600a4360be19036357f
MD5 626572c95e644fdbc3d155531f89751e
SHA1 aee48bf9ee9315e4c7c5d6653889a4f9c0954508
SHA512 22b3f81d2f676671831a6e753ffbf43fb637773227f59a05235ae7e8fbbbcbb1c45c5008889a656100030b34bf7c1ac2ee0da96ba92bca620c1bda8a48a26f6a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f0985668c16af1aec1fd9a84533428b629006315d5fba7287681158ea6eab0ed
MD5 19bae592f501073c739ceba13ed8d561
SHA1 5a74d6667825c491ab3d54ad34a1832e520197bc
SHA512 014b449773b5a3cfb9a3b9b36c5edd1c909d3f33b8b69e03770e6261df7e27dcd741a515887b7d204b1036a891c3917fbcf4b1e8d420c637d4ab2b156575ab41
SSDEEP 96:tDT5hLiR0Fje5LoJ3dNUBPPznKqR4ZXTGuplDl8luKl+lHlANlpljl3l11lKlsOy:triWCLon6RWZ1plDl8lFl+lHlslpljl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9c0a2955c52b816d85aeb69118410126840aeefea3b381aa7183d02bedec8870
MD5 3de16863f1654e5637c12c340e441e2e
SHA1 a5fe828bd985893ef0d3971f741a07b7e2361c40
SHA512 e410965da88e4f3b51ade0e6cad91f977088b08effdf03c8ccde5eaa87693f44cf22cc3c5139df288cb5d0b62b8f98d76fedeafe7f61bb57c5fb510234122727
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b56f606f8e4499079688c8debf90ffd1a2f8b41f0e7a6f6e3194d1d1ba89df72
MD5 9d2b51e74e51426122df1c90e727254f
SHA1 df4b1a77c6016f7a1c8433b8575c6e6ecba30a2e
SHA512 25cf26d36fed80afd915c9758986c60fa3d8702929c66404eeb27eb65eee896f2aa3592dfa6f1c77ee228d8982996e4c0479d66cf8267550973db2a72b0caea0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 5bf6cbb13875d2fae0e05a962bce54de514299479526007a45fc4e678c003d28
MD5 8276e4fb7d859a3369f415e50593d6f6
SHA1 3e85bfcd6b27b9716259d15105122788fae259c3
SHA512 6d443ed6a4df5e725aa7c6696f7aaba15508d65a84cf610109e8a9ba36a318e612f650a66d34906723fee7a34318e218990c9ad1a8b6494537e9657f96e964ce
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 ac9cdc15a9564af17a54a4b8cb40655ce5e418a032910176194e425828fa41ca
MD5 2deba264227190fd078e72771e99b24b
SHA1 f77356080f3f5a81fb0d6484e1e69a054ff5c0e3
SHA512 3471c700f62b060bd98084c6f6d02ca764d344cf6307c28c4531ef755c1ff5a49a9594e60ec8ce5ab0e142cff0ace230b37e721fc8b49adb7cd648a62344a3d3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 306453aa3d45b8a717008c9cbdd867856556ca4c9b4679678bf0215b9e3485cd
MD5 2822a40808fc764e837ac6b4594ee479
SHA1 17a4b6c182ba96a4964a82657ae951b78ab835fa
SHA512 cf0f0a60adf7742f352a9a4ea5e6803fbad3e8f41f5c92875175dd808e8613326957b3e384ddcff26ee38557542f308c5f1e33bb721773d48f60c0156ac5465c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 045ad72ec9f0ec7decff57831c41b8a05e43a2b3c892bfe92f9827fa0b272ed9
MD5 b77b9cbad642a7f28240fdd4aee63f64
SHA1 010dbeb9ccfbd1b5e4b9489f4b4a70c7ba0762ef
SHA512 fd22e6a36bd62387131886db720dd58cefbe3085829dd264021a6a30e2f669cef828e876c55306031af1f9fdde073edf3078071dd965c4d2580031cdb767f4a8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b8bceee3cd4c7afbdb8344d0577856a8c2ecfade26d07086c4f454d5165f73ad
MD5 d7177734d29021b7623ff0c85280cab4
SHA1 94dcbecba4a6f344c7486a9e473c568c24ae49f5
SHA512 cf6558944a5535dc7f8c4dc728b9e74af6f94cd61498a6f4da5d18cc56adaf614d4b1db7c89292be95b194aab7a6dabeec8323a5c0309417c379cb7559caade8
SSDEEP 96:nwk2a1JFwp+eOWMoiVmdelub1jBrR0vUWQyV+VD7AiEwb:nwkhDFhRWMVubhIvrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d158742bed4124cffee20052a690a10378ae908d7c19dc410c1c8aff6586df92
MD5 0b360056032dd6a3a71b34d72c1634b0
SHA1 e3010ee58eeb9b27476adfcc5c4892ce292c58fe
SHA512 20ada452c48f9d37d308fd4974ad4f7f74cb3c9ef9af2f818c7bf103cd6513d9417f0fed2a649b922ec3d9d3a9041822be01cba58c1ce5212666ef4d3b7e7978
SSDEEP 96:nwkha1JQwp+eOWMoiVmdelub1/12BrR0vUWQyV+VD7AiEwb:nwksDQhRWMVubb2Ivrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 93e2cdd8911694f82db360aeaf9c8a357f153ce79bfb051af666cfbb454f509f
MD5 c30ba7bd1fe5dfc1cb1dff197b9ec715
SHA1 230c05cbeaf93039b0d7f626268b4f924c8655e4
SHA512 1bef3d1766feef82f7dac3a7fb9496677d93738b692b55321f142ed95fd72ce49704770f5e202f43db9d14011fcc5fcd35088f07f3c9fedfd6ebd54fce2bd1dc
SSDEEP 96:nwkTa1Z1wpvWMoiVmdeHBrz0vUWQyV+VDCziEwb:nwkev1GWMX6vro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7046803bf4457ff4380ed766a57af4ba6248f738263b2caff2224dab86b7cd90
MD5 55567de5dc6f3a66bf1c53bed0fe42ef
SHA1 0f67f2af9c98b187e6f496953099c286fdec8672
SHA512 07950c4e168638f61d1906e54f9abfa94e623804feb9b4239830c9639576aa0c83d3ab5d9a1a3841199b916de098d180fcc918d2f187cec277abf1881de717c8
SSDEEP 96:nwkWa1J1wpfKuWMoiVmdelub1jBrR0vUWQyV+VD7AiEwb:nwkBD1IJWMVubhIvrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5144f83dfea6e7da690029bc9dbc8b521148dedcdb2160bdc31ffc1c0cb22f43
MD5 55e6dc63307044a60fb9d48f0886fa31
SHA1 2f44a41f97ea608c0812bf24a5ddc08fd5768215
SHA512 03d3ff82830428edf760505adc442eafbc12f4ca418e6d26e13b05261850908a216163662bfac48dc03cffc6006a510a0dc05fc976ad8025f7fd70187e9f15fc
SSDEEP 96:nwkIa1JQwp+eOWMoiVmdenyxhVub1/12Brk0vUYQyV+VD7AiEwb:nwkDDQhRWMXyxLubb29vVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a91be58c9dd1d929c4a7db5b456852b3d925ae0a635bcf983a74075672887381
MD5 ff5bbbe5767077f842e4f0102908b1a8
SHA1 da6a71575e142c3e3d21d16f9bc4258189a44c91
SHA512 e9b3ae765e39d253e1e2f4ceb60625738abd75a074d0057c6727c30686cae1c557d56987e8e6b8a8359203290de14498ed801bd549c176e0786fcb7b8c7da51a
SSDEEP 96:nwkBa1JWwpZelWMoiDR5mdenyxheYDMk5GfG12fwnrK0vUYQyV+VD7AiEwb:nwkMDWq2WMDhyxQYDiy24VvVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 82a639c2e2468d1fb23c43f435c6b5d4fcb4e2c1493bcc8e5d15ab94bb80afb2
MD5 dcd7583e6d385e0d1d50a591cfa01190
SHA1 4e5228935e6535cc7f9e2fefa5d6e41f8c1a45a0
SHA512 7c2d733b0b5ce0499ae9402fcb71a31d9ce299b252e7a84a6c2d7c5bd0dabe2bf196b8816a1870a67d30922ec035d4d84f8cf9eb71e5d51377f861156e497908
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 97eb94535e16e9f4bbb17e6d89a36be9d3914293a75f742cc4edda1151b21867
MD5 d9894aaeda63408d94dd82ce1b9d1f74
SHA1 e9b2c8af0c8b19a0fb1aba86792cef0f09b2d9c6
SHA512 241852e3874c3ed5749dbf42cade5f4c222683300feef1de0eb7178390ed02bac2405318e314c0b986b5f22491ffbca9eb000757443182a5f61b768792e6e98e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 204d73720fc067b794eb8975ba757f9203a5a763f407fe73f953c1e439329baa
MD5 29b2903e6dd6de54d983205382175116
SHA1 17cc42bbbf2b163f48d2c876fe79e155ab8c2d6b
SHA512 badd1fa4ef3465ff445e12ad06d5c64e743fa96cde5e23ff6042e990ba081c55b090c8caa969bd38f590276c5658f7a1bad3cf1330c95c5bb92e69e5603baaa5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 48a01fad3d8b1c817c85f1c7b8cd08a38fec0048393ab48e8a032f9a4dbb546a
MD5 3e66722f7b4bfcf1ab5fe026b9c88423
SHA1 77297fe9dcf7f0f55f269f57965ff04e65e161e4
SHA512 ec2d661c19978e60e8d9308c7e496fe53323587e904f28a382a1bbf6e1b878b350f9b1aa0f746d8b38ce5dc2fa9a7b2becf071d52e3fc874c9e6e2d0f47dd238
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 e013a428adcab598941349817d32ac9dc7749c9320ddd17a84bf0d9b2d4fef81
MD5 ff98f490717a8e3f9b1991e483a4f6d7
SHA1 323c1002d99a7a06f7dbb2a9662c76d4fc193c65
SHA512 75bdf01e389cde26c74b6ed5fa85318cf8a944cf4a0cc75051c33c46c755238d867a895c1cdb27ae894c9a1586093d313fec4b6d87cab5ab801acd535a1ebee3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 a38c22984e53a74a39902e8e2e14f8b997457539de4d5842ff229a502286deaf
MD5 7283f46b9c75c2d19a713d4520eece88
SHA1 df632e850014db0cdf839b143a5dc617583dacab
SHA512 d6a4d27ca32648203634e7fd4191c3b08f1367c8c6e232581f3f37ca93f6ac80b444531392a857d2a8e2ef71a547815a833fb6c9be2ca70a8142449dc26e7a88
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 52b933502e8f8805faa657a461cc7cf486292cbbb6ae625313e1de4329be7b8c
MD5 b5c1d9bad345b2f734490cd7d2e1373f
SHA1 d3da375661bf3769dabecdc361f6d629801a08bd
SHA512 1c9193bcbb58f4d08848cfe7a71f25b23d91d19d7b1ecc4699ace2d5ee47f11afb91e637d0805ada5c69de805294f694993e6fc4bb30d5c8152169a3feb63724
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 97dc7eb7f915f7a5226fdda7f63a7614a4e45f1a6dd2e467e000290e3c37b480
MD5 ebf9121e69cbfd7c16bb899571451320
SHA1 7cff9fde3a1b1295405c8ff89c554e27019cf40a
SHA512 676d9f5aa2686be938379cc0d7578ba1bd118d459a4e30d9cebecd1596ffeb8a747d59d494b16bff7595dd53e43ae0f7bda07fb8c5c0ec3feb95247383b375b8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 0d15dc37a8413d9ce69d9b15f6d5c6674668f33ca46fab723d2a62843ec9270d
MD5 8803e2d7319c9cd0d426d443d188c705
SHA1 c79e05617bb8e7d63617f151df2561eee599ca7c
SHA512 4dc8d5a9d172adc178663d185fe334875027353c0b7c44d4c814004e1b223e4d76e008d5deb45046a0bee281118fb5f4c62b6738a6b37203324d651b5a80c322
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5b438d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b438d.TMP
Size 872B
SHA256 322659d3a496665dea12b7eff2504dbf4d0103fd6ea06483feeb5289d9b2970f
MD5 322e0ccadb6a1cecc3e6a097494d220a
SHA1 d60763b509073ecd8942e9066c2e8c9c27520b3f
SHA512 8948be2a64988810ff2c31df2cb92e18882140031cd1c61f5f3ac47f103a6c790df9f6739c4ef52794bc5e23a7e168e17c37b3206937e13b0280ce9eb854f933
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ab9b0fbf1298697430c45ce1b2d7848b23bed057f861fa32473e0419e77a2ddf
MD5 bf916cbffa854298f9d4b59a556d7733
SHA1 3e54fd426f9339c8fe3ddbfeb91cf3ed63a785be
SHA512 01bd390f20d9d868ad2b638f90e411054aa4b52e3a92ba5c0c3cc19958cce70763053c6f6f728f303e78c54f130de587a0f252078019deed96bc8314ef8d0cdf
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjHe1Q2RUvMj2K3z2OMDCR7:A9iIxuERzA83h09RZxYjHOFyKaOMWRHb
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afevplna.default-release\activity-stream.discovery_stream.json.tmp
Size 23KB
SHA256 768de0e6035fb14b1f65a240584e4d792ace19fd4e527efcb97227309937ace2
MD5 fe49e2d01871b1c89f82cc1a0257fc34
SHA1 52f239cf5588a95e79446a455480cf2224e32e02
SHA512 e1840e2d727718eae5d3896ebcaebaada045b8cd292a5bbd6cd5adb0cb5d974429cbf03fd8e923de49223fb67b334f95fe39d90bbdc3a7c47d0e0f1339ab6c26
SSDEEP 384:rXk83q0FzX+3F8dlOuPgc/0DVavTI57SMJ9288uJqHtgEAujyaa:rXkmxZ+Qfz0kvTEvuuJcvAgy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

9D67DE63BC05FC8C2BB415AE05CD43D50B4A1D70

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afevplna.default-release\cache2\entries\9D67DE63BC05FC8C2BB415AE05CD43D50B4A1D70
Size 60KB
SHA256 110ec9030f3da333a4096c643a0c44db9d778f5bf4148bc0372976a349eae6d1
MD5 2b8b973330e8669a78d86f618dd536f2
SHA1 daa1f0cee86ea7a1e36935df4c31fd6c4c9ab72f
SHA512 57d3fb0266859b0399541cae10515fd70a326997cd5dc2177aa28f8419a5cab9c1c771008f57cc3570c87564d5ff6de1d686a5d9c795f02fac40ff481e725c09
SSDEEP 1536:YauKio1X+3rsHRjk+wulX+3rsHRjk+wsREBaBw2XH:YauN2X+70ZTX+70Z/Bj
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afevplna.default-release\cache2\entries\F4EFE37A30D0F14C6AC03FF7949A51CBC2EBC649
Size 13KB
SHA256 e2d40e032e07fcc9492d064f7879df74700afdca8ba3dcdfd91b52aa7e39ba5a
MD5 fe9dc4e711eeb6010f269e5ae2f5a80a
SHA1 4c140800977d07c93d56e93aa74a37c0ca17a579
SHA512 c152ccfda503d7374c7462763bc4642e34021dfe8ef918d71833e40f92d199fdb5126d909385111d647b4bad01803d7adfb7757dccc66982fe54feebcc6f4ebc
SSDEEP 384:Hlxu9fiGLm4pUVuL6eFuFmn/4OgQ2TdlqGPUcP+AWRMACiZ1emZ1eo:SBi8mCUVVewUn/4dlqkD+hRMFxVo
MD5 SHA1 SHA512 SSDEEP

Submit Download

F8CBD54DDA10F4286A41EC6A537240712D6C2308

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afevplna.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308
Size 9KB
SHA256 dc8a1e0dd6f9190363791c5bcf309df73cfeef77524083f0fbf6892a7a2054d9
MD5 18df49ffefd997ef663baa34e4d2929d
SHA1 f6bb4028722d77b48e16db3f3cd8051613ae7ded
SHA512 52f0e0fbcb26acc5e5ac5fdc717f6b0ce42c0c5a25ec4158b491ea70001b1024d21ddf76ccf4088685d979a8113f141f72ab0dee0dc62fd1025d9cc8cae8349c
SSDEEP 192:HN8Q41r0dZ4eYvnid1ZFvC2rAl7YNCW2P8ro15j75ywpskCjdSQdSg:HN8J1r0dZ4eY01HvCmAl7YNFU8rIVy84
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 4e3fb9471190f8452175ad1f2bc9ae692092ccdbc7832f72b5adf31cd65c2902
MD5 09fbcc406627b73e0f9fa2204342c3aa
SHA1 e08258ada16a0c0eecf2a9eaf0a01b6adeb4b1b5
SHA512 970d35c826427bfc76a914958c50594dd79ba3ce02d7d7e0db439a87b02bef2799be21b6e91408e4b070f03100aeee82a9fd69b894e6820fb12b1d09498139a8
SSDEEP 96:hDlJAhXxaw7hXxdHIJzlJS5KjwC4SzlJBBw8mzlJ3uYJzlJnIul:hhSBRBdoJRAIRuRNLRBIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs-1.js
Size 8KB
SHA256 3132cf895999479b49e77d3c5e1fadcca4a882532693352a8c773611f711cc37
MD5 010b83612f1093094bf57b131a68823b
SHA1 e45ec72095481dfedee5a77816dc787875a9a99e
SHA512 0d7b84bd24efc34f5927ae0809768fd1451002cc6b55d6beb795da8651e9f951067461178ea793418de51ffe4af18884175ea484e214174509662e9a3981d6c5
SSDEEP 192:x5nrRuflT5y0Xb+3IYSm9xzo6FBw8HcRESo:8Z4IYSisAwof
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs-1.js
Size 10KB
SHA256 d8bee5a9ce5016b5d90f1c67108bdb122cee57ecb1b490dcda461c0e48cc17fb
MD5 ebfd0a86798727830a4a20c1751998e6
SHA1 ffeb4512d1f92fdccad2a0bd1da03a31f9df6ad0
SHA512 8dbca0b0ee03ee3c37bb4575181c32555db79627799939767b4105c6d61b8c21bfd7f55ca6cb633e57639d045b62d9d0611dacf0ce7e9a52279c759f7de7174a
SSDEEP 192:xunrRuflT5y0Xb+3IYSm9xzo6YRBw8HcQ2So:/Z4IYSisnwJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\prefs-1.js
Size 10KB
SHA256 7d1caa16e4d7f241ce66e03a82f28677997a102ce695df6781a6ea5bc0099930
MD5 c7784bba6ebf37146de9771b29cd9da9
SHA1 37f79f5067158e957f4110e5328228f2e7f2b9d1
SHA512 3338a29a806e098153d15eb347f34b290951693edee3fbe08345214f27715e55ee274dd625162d00950cb5021c3d66af72d942d0c090baeef4d10779c3f59a32
SSDEEP 192:xmnrRuflT5y0Xb+3IYSm9xzo6YRBw8VcQfSo:LZ4IYSisnw+f
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 6bab1a3b0ed91b3dca88844543edc05e11fcc5f3a4a6531dc8f092560ef1ef41
MD5 899ae92ba81e146472c569ef2514450d
SHA1 7fdf00ec4289d9f1ce76ba34e3e1d55129ad5853
SHA512 6ffbbfee28746d39a7302153ddce5496603b2473c9e9b9e849a187dd28041387f0da7d54f710ffcfc5f6dec7f4d793f8c093d2242f73ff039b537ada94cd77f9
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 588f289e4afe2a5662e9f7d171eebc2880177e9b1fffc385201daface50f266d
MD5 679400cc5323bce0d29ce39ff48b7972
SHA1 c49835d72d7c6ec3f72ee788795fe19d48c9dedd
SHA512 f63e578c2b8768e23f4891d823aa1da9a8750e204662e186ccc3d6dd56ee637ab8d97e43d88274c6d1809fc4bf19e3e5b990572184db3fabd9433b44e6fcccf1
SSDEEP 96:c/xoMmD1zQq8EMJF766MZk0zf8W8QZ3goS2MhdGvp1jXYn7:0oMmD1zhRgFLMZkcTLoGvp1jXYn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 e749452fb38b5048f5b1827156260917c2f61b0fbc859a4e59d16eda7c1bc28e
MD5 b8a2a7ffbe7c9d23362269f2e76ebf29
SHA1 59fefd9e1a05a2de4966c61ca58916360c5efcd6
SHA512 45cc8ed6087a80e97b53bcead3931dc946198ad10cd20131ae8a3822a3cf6f8bee729375ea1d8ecb7f364a04c9d1057e9d1c0f3d51b7759e2ce7ffbf7c26a358
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 90b83845fd0fde7633d370f469893dbc39a90629cda5e69ed63b23b10c844d7d
MD5 16f0d25206cb0e2cd97fec9d4728dbc6
SHA1 6896dd2d9c3193caf0df3ff5f9e1311d428eae43
SHA512 6211a3eabc0e88830af6152f9fdf1866933f46b3a034340b8c0f207493c33503e57b8da0d7ae3ae1b7417dc2a467cc4887f84e042fce595d77b2acf3f9f7f354
SSDEEP 96:z/xoMG8EMJF78MMZk0zf8W8Qi3goS23WoHmyj5:FoMGRgFtMZkckLrWnyj5
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 a7ddcc64776f6107b19a0ae32e41b0906932227030dd579ebff8b33d50246b88
MD5 5a439cea324c77c8245c43a295e877d8
SHA1 a5186da83a5d546afe242a05419e3c2032c07a26
SHA512 f198f2513129095d07da392d64043f82d3cd4d01f885feb68c568356bafda44af0b8e140624548e5bbc302540df21d751846e89dcd40a6f0f540133eaf6662f4
SSDEEP 96:c/xoMK1zQq8EMJF766MZk0zf8W8QZ3goS2Mhvvp1jXYn7:0oMK1zhRgFLMZkcTLoBvp1jXYn7
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afevplna.default-release\sessionstore.jsonlz4
Size 4KB
SHA256 7d68d0714496a13fffd09f9bca67221977e9f0882b91169e2b142388a42926f5
MD5 af36b1081cc3a45f3c1b897ae35e1460
SHA1 853224e2f55bcc295bb711efeab2959502531d68
SHA512 2ce5230d7649026ec55b605e485e42d4db6b57ab957badb69e5fa52a5af61e065daded9901ffa4d47f7339d301c6e2592fe87982b83f62f345b3ccde48321448
SSDEEP 96:H/xoMQ1zQq8EMJF766MZk0zf8W8QZ3goS20a0w0:JoMQ1zhRgFLMZkcTLwHP
MD5 SHA1 SHA512 SSDEEP

Submit Download