hxxps://drive[.]google[.]com/file/d/1_GDn0burAyUzKX_RW0bhdByxy60AHC6G/view?usp=drive_link

Analysis

max time kernel
679s
max time network
799s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
29-07-2024 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1_GDn0burAyUzKX_RW0bhdByxy60AHC6G/view?usp=drive_link

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
6	drive.google.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\.dmg	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\.dmg\ = "dmg_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\dmg_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\dmg_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-47134698-4092160662-1261813102-1000\{A1E0946E-3EA6-48CC-BC9E-12F22423487C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\dmg_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\dmg_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\dmg_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
3956	msedge.exe
3956	msedge.exe
3860	identity_helper.exe
3860	identity_helper.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
5688	msedge.exe
5688	msedge.exe
5964	msedge.exe
5964	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5840	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	firefox.exe
Token: SeDebugPrivilege	700	firefox.exe
Token: SeDebugPrivilege	700	firefox.exe
Token: SeShutdownPrivilege	408	wmplayer.exe
Token: SeCreatePagefilePrivilege	408	wmplayer.exe
Token: SeShutdownPrivilege	5448	unregmp2.exe
Token: SeCreatePagefilePrivilege	5448	unregmp2.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5564	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe
5840	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4524	3956	msedge.exe	85
PID 3956 wrote to memory of 4524	3956	msedge.exe	85
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 628	3956	msedge.exe	86
PID 3956 wrote to memory of 1688	3956	msedge.exe	87
PID 3956 wrote to memory of 1688	3956	msedge.exe	87
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88
PID 3956 wrote to memory of 3312	3956	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1_GDn0burAyUzKX_RW0bhdByxy60AHC6G/view?usp=drive_link
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97c5c46f8,0x7ff97c5c4708,0x7ff97c5c4718
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,8761455190754136167,10913990012390776335,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5964
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
  2⤵
  PID:4556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
    3⤵
    - Checks processor information in registry
    PID:1508
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
  2⤵
  PID:4688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
    3⤵
    PID:788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
  2⤵
  PID:6040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
    3⤵
    PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
  2⤵
  PID:2572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 25757 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f25fdd2-df5e-41c8-99f0-c91a6eb71df8} 700 "\\.\pipe\gecko-crash-server-pipe.700" gpu
      4⤵
      PID:5524
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2488 -parentBuildID 20240401114208 -prefsHandle 2348 -prefMapHandle 2340 -prefsLen 26677 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f0ddc92-99ef-48ea-947d-6ffe2e1456a0} 700 "\\.\pipe\gecko-crash-server-pipe.700" socket
      4⤵
      PID:3716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3176 -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 3472 -prefsLen 26818 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80c16a13-3c72-4e67-be34-1cdad36546be} 700 "\\.\pipe\gecko-crash-server-pipe.700" tab
      4⤵
      PID:3108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2336 -childID 2 -isForBrowser -prefsHandle 860 -prefMapHandle 3652 -prefsLen 31167 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbd91fd0-fc19-489e-bd11-92b081ba55f9} 700 "\\.\pipe\gecko-crash-server-pipe.700" tab
      4⤵
      PID:1416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4704 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 1528 -prefMapHandle 1532 -prefsLen 31167 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3adce790-77b0-4da8-8ca6-326970e4c8ee} 700 "\\.\pipe\gecko-crash-server-pipe.700" utility
      4⤵
      Checks processor information in registry
      PID:2752
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5440 -childID 3 -isForBrowser -prefsHandle 5448 -prefMapHandle 5452 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10416d35-8489-4f18-9436-ae8ff6b1432c} 700 "\\.\pipe\gecko-crash-server-pipe.700" tab
      4⤵
      PID:4208
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5544 -childID 4 -isForBrowser -prefsHandle 5588 -prefMapHandle 5596 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7eafc9d3-7487-4695-96d8-848f53e176ee} 700 "\\.\pipe\gecko-crash-server-pipe.700" tab
      4⤵
      PID:5168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5836 -childID 5 -isForBrowser -prefsHandle 5756 -prefMapHandle 5760 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20b90c39-836f-4b76-8629-b036b87a1540} 700 "\\.\pipe\gecko-crash-server-pipe.700" tab
      4⤵
      PID:1740

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
1⤵
PID:4904
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
  2⤵
  - Checks processor information in registry
  PID:5416

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
1⤵
PID:5476
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
  2⤵
  - Checks processor information in registry
  PID:3724

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD](1).dmg"
1⤵
PID:1212
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD](1).dmg"
  2⤵
  - Checks processor information in registry
  PID:1500

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" "C:\Users\Admin\Downloads\After Effects 22.6 U2B AIO [RiD].dmg"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:408
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5824
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5968
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\_proaiXs.dmg.part"
  2⤵
  PID:3828
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:4092
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=501FA61723E9CD5124230EC25A01BB3E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=501FA61723E9CD5124230EC25A01BB3E --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=01C2766553E1F2DCA4A6813A7CB068DD --mojo-platform-channel-handle=1804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:384
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9D0B720BF46CB55C46D1E20FF34BD95C --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:208
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6BB03DDFB4A89A116FF5B21D4052AD6E --mojo-platform-channel-handle=2024 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9BB7245D89354F6B78E83FF48ECECF69 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
67KB

MD5
1d9097f6fd8365c7ed19f621246587eb

SHA1
937676f80fd908adc63adb3deb7d0bf4b64ad30e

SHA256
a9dc0d556e1592de2aeef8eed47d099481cfb7f37ea3bf1736df764704f39ddf

SHA512
251bf8a2baf71cde89873b26ee77fe89586daf2a2a913bd8383b1b4eca391fdd28aea6396de3fdff029c6d188bf9bb5f169954e5445da2933664e70acd79f4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
384B

MD5
92762dddc46d3193067f98de83349b3e

SHA1
f87de80313390dacd6b66cf8f413f7c0f01d4b88

SHA256
a206dd1f42cd9c337971548a7acc83435b4964814f2100dd2b8cf75f2ccbf9d2

SHA512
c45d8c8d68b3d1a4413ecb583aa89c9eb9822148740887134fe11e67afe9b5c3eb44d710636ea18f9fd385418e1d4e750633c3c595df53a6c54d3b10191de554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
2391eadf570fb45c2211cb4beff6e2dc

SHA1
0b5eac38811c719b86316e6afc488bdb04893934

SHA256
a6c6c47c8aeb81d5af4ab30d382276e35e16484a10f97df9dea64129748b3559

SHA512
f104a6666f4a39cc73258de1d4085f9b9d94697c1bd0c6ff85d3edf9ef983799b57bf9a129885cadb2d302ccf718bf71b8d31d5cd0d514e24af2d88acdbe7c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
515ab91397eb6d16318e1db911b751e0

SHA1
ce0a2dc8706ccbdda32c2b8a65f97da4068fbe48

SHA256
7beda1e7e6c2ccdd422efec7d3a9c71e99ce54b6f486258955da16580b8e799a

SHA512
ee0cdbe0c5e715da49abe2a8143173835e09235b921e06c63ce779df68853ec24a4a95232d621bf2186b343627696e59f57ad578cf1ff57d23ca8f4c3c55ead0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
040bfa60a33d9c47666c7ae8610e4053

SHA1
b97085f128fdfa3c6221e1590a914d0ad4a296eb

SHA256
8696851f76693a94242badb4e0f86393ab14a6b259debcf08b426ed95880e285

SHA512
1dca12006dfb3b7b34e7cc0af18be46e3800f4407c9aa21f8aa7a43fd9dbf84ba0d6c15c94e2611841cde1b936f445c0e5f2b87b48791be2bbf7d4ad37d30022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
171253ff577efa8ef34b80df7b663ecc

SHA1
4ded6005c9e8acedc990e2a61dabe2030770579b

SHA256
f81c17503de634320236308869a44240b04b1466679ff863c061aa2475446d6f

SHA512
4fdc682442aaccaf632e008f3c9d52b350250eb8bf8447abde7348938973ea840da2c2b14b48ebfb18037322fc533f0ad2c158e21dfc1e665fcd814defe631a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ccb558586d7e8d9dad4423a81c75516f

SHA1
d60f51e410db401599438c123615fda05657cead

SHA256
eee682222c00c95c85cad9285640d2ece8907401bea399f1f46c89f238a07ad7

SHA512
eec48cece3fc6747e7c16d4425ce9ade9e8bcb6f74259b84ebc61d27f5f9a89c79010a318abfed4a72443d4a8c5b88c757bf4db020584799cdb9a70c75d8a343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
1a5973f852c788ebb7fc290637a086bf

SHA1
f88c483bfd1266d24bf5d933d6bcb6068dcd688a

SHA256
2de4ba28685531d3888f74df93b759ac56b686283c524177b5c5ccc137f02a30

SHA512
3361bd7f24857492b5319c820efbfe81057f945505d2733841fbcaea6f328e2720527379fa902c0550e75d65f63dbe070b7b5fa2628e217a20dc452f9251c1d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
12548686b71fc042a9e3aba78f6ba787

SHA1
2773c331e1a75e640065042d0b6831ff8d7d9111

SHA256
d3089f80673b14785b6dbb01d0bef4f0da8c5195a0fef487b5b8de9c57bef107

SHA512
a8fccf7153d69f860ac0a87a5941103bef20e5d987d0c5130d7667c636666c1f1de38096fa27b1e9ad58bba7759e7e93c17163b0534bd61ab13c8d35c27b50b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
82cd7897cd391f1f424ce5b2ff2f199d

SHA1
cc2f950f80cb8cb8a0a0e1a3931c128b44e2c9c1

SHA256
fddc14c75308b04d3c6fc88d6a9c2be882a40906c76425abbf213f8153c1e8bd

SHA512
2c5258c221cdc10599f3c5c20519e059a7461fcd5e10d5bbc55a52790c6c33034a1df2ae7ff6b31a0be3a869d523264193ce605f2e7fb117c92c497c06e30b6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
db6793c7200e80ab5b69ff7769dd0f80

SHA1
ef102bb3dc76f150034e7ca66d315f44dfdb48a6

SHA256
e0cc29ba575d3f4a036cc8bb065de0c622ff1d61baf7cdd8ca887e865976dafa

SHA512
c5b655bd04dc1f752d238697ef14934a35d84db039a3159d787e56246d75e2bbd0eaff096e228a62296016c74135fd04fb4d6c5426af40f1c33a3bab8baed2a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6678b4f8e611c137a260f86d81bcdf61

SHA1
9607c60cc577e5239a69dfe950d9ecfc84406de8

SHA256
ce338621d7d93085e2a420f5a5092f2465eb84d6813123e2704a492024259661

SHA512
d816003b35f1f3fc48d1e3fe68b1d3a31c8bd9219f4c6137d9b1667eb0668bbca012c8b831b2b61c4ff017adc4d7bb9f195a67c86a8fa56adf3a75fe47af209f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22656ec5b04c425e7eec074a4d7b2336

SHA1
1377eabb1b27860c3ee122d9fa630e301574f0a8

SHA256
8ba9bac6c9714c6806610773f7da225eff734cbb7f91cbb44705da5d698ae56f

SHA512
b6e3b656299d249cadc899460dcd80a139db1f15e6b3894fb13af0a2c8acad0c01339f7e39ad6d957eb793c69b95b2cea1d8c4e04f1917bb42270a8d9a631bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db393b40a0581288084bbd369154fa40

SHA1
c5d4594b65f922ed434256c2d354b5af659016f2

SHA256
64d2041b444cf93a84566995a4116e6d34ccf4255e8d6fbc7be9f5defe8fcc42

SHA512
3705b3544bd81a03918825478feaad06baa282ebc074bb4d657abf28b9c3134312b411c223382a8c1b23ecadd2da12079b6a24267e5721bbf52498212a3a1e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8767caa88f930fffb7805c043ec9cf12

SHA1
2d61d60ddbc273c0aa2cba2269e66bc4e7263dbd

SHA256
7a5f726a068d47d663f95d4c9a80028ba6614dffa166533bcaae620255930a6a

SHA512
76f6e1c4fc35c4c55e73be43e3d1d7e61cecb20283e9105a223d73bdc0c08944c4aabce21c34d2121ed57e20680de9891806f33c1ddc66573ab85b70258965b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
af7d7425f8e16257887d5b492521365f

SHA1
b225edde9dfc235eed1c872ced6eacdf6937e1d2

SHA256
880b2d20f42097abde359ac28ff4caa33d8d52a4fb29b9472cf49def19d449e6

SHA512
a93458cdbd3d2e2d051637fa7e57b5e4c990d47f53f1a60424e8e729141bde335d70d232bf9740cc684613f9bfa6cc72f150846cb9a983cc10a59c9726246f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d2485606ca5545dd54b3db4f5e7741a8

SHA1
25e99dd44aa626abba873d29c4373ffec426d328

SHA256
ffb09da6d8f4ce03914f75b33ecdd147654fad2ab2ba4fa46deb0091fdcf16bd

SHA512
b54e24937523a80ab4fe1a38f74649e5edcce9e9be83c6606093d5e5a040339ef776b3d591696b7fc3ce4e523ed70daff35a4b137dfed37de76551fed03c9201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9baf6b647406ea35b01a5b5e5938a43b

SHA1
6d835d3f0575db947bae8f17ae5a709712d07e4a

SHA256
4af7b16b70493a4427222b7ad90db50259f3f2d6442144e38e215ef2b9899a2c

SHA512
7ae2722bf6779d773d1ca1881db762e57ae5f7b345e23e58e21111af4b94b4edd5327c0a5ac560315a42bcf0625282b29b82e5e4262d09f666abcb0bec902276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
62571b95449e0b796d35b19a43da2ec9

SHA1
431d8a583438792382323d5be721c3f0d6a8a14d

SHA256
57f13eda31c9fae6ac69ca278a5616537e8ada04d9029cb0159cb4eb4e1bc1a2

SHA512
fed0258d74236c3d740d3b87aad195d6e7bcd041ef6a62b5a097e006a1ed984ed9d832a079a6e8ed3aaa3664a5b85459cfdd84bb0b010e9645a637dca64d4173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d8dca4b5529c4acb73c06ddb83797c4b

SHA1
cb4559fc4a34d268bcdd45318b1d4a0905eb0a14

SHA256
d48166cc44863a63761a54ae326d9858ab9424c54ce55e349c0daa8c4424715a

SHA512
fa0ad65937595d97451ac8116f6e5dc2a56a96a447a73e73e4d429318dfdabe6e03d8fdb13680e10987d440eecf656a1ef05bd9b8d3310fdeae613024de98139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1ac4ef1ca47600b6ab92e917b1329941

SHA1
5f86307e4f4f6ee9a4358b7480bde8e00af66e24

SHA256
6e11e101ba67525d467bee15a19e10a1a08a766c4506840549b40aaed22acebe

SHA512
65389feac143b0bf5f7dd55591bf6b774be7809c3bdc606b769a119682bbe16d0fc1d3cdc2058a3fd60c6f5b5e53504815c18e697af0e0dd3f5b7586558331c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ababec8d6cc8bb56ea825880b1290868

SHA1
a274c1b40247baa0cb9d7459a9ce40f4ee226962

SHA256
934d060d4daf5a532fa8330f5e31bb6ca186403f9fdd04a50515f73de8fccba6

SHA512
8cc0c136ed34dd45a118e42382d2dfde2506b0a112b7c8ad6d884cdd617cc715622293c6ea197ada4ffedef3c752eabb3a9c30d71416ba055c3fa3d79a9833f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59625a.TMP

Filesize
872B

MD5
be301d5144ffccfc9e9aee80e0027e97

SHA1
fca4263aeba7b349a4b562f57144f644a84231be

SHA256
c7659b2b211ba9edd8b45f1046ceac21007e8f5b80cd67853c728b5661e82fad

SHA512
6227dbce82530cca9beb00e87ce9d9e51c60b1c45db811ad2ee4c4384a1a6815eecd5943bae0c363b457e4e5787aa422a62bd7ac283bdc4de94c0d18d4bc6298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe77d3f0-662a-4bbe-a3f2-79763ea9b92f.tmp

Filesize
3KB

MD5
0ec241dac35e7563fc3a83f862e54b45

SHA1
adc52897f48cbd0cf05e1d5254ebb8776db36374

SHA256
b900107f51f27b85d6a57a5cd6aa9fbb5a198e936932b955768194d5a1aacb9b

SHA512
a126b47859c565e82380a15966428e3d54a692c7920253f0254bd63b3693b6af27f50be24db23f3b71922444e690c15bef6ae389fdca3e2c4aa91a29ab1e985e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f715d161c2da7f56e242a576ce67184d

SHA1
e77e3fc4e3f0ef5e6609ae472c4d2b348453b90b

SHA256
43672b09e894a77c5e5aeabda01df8e807caccf8b03ee23323f64ef3314a334b

SHA512
380719ef630a0184e7b38e0de1e8185b17c546772b8d763cc7456b87f6d089da73e250713721446a25ab3170835aca1ddad7106512d5c540475d94c7a47634a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec1f4a7d3dc30cf7d3d01dbf4c1672dc

SHA1
b7d2bca9783e290510a0e3f9c977cfe9cd417aad

SHA256
4b1242cdbc9c8a438a354d1ff9b7f181c8cbb1bce90e6ce6ba0aeb50e1111edb

SHA512
285d99839f59c09bc1104430a393f16ac5f238c5d5439495330a2f9e04a5e01f6e53b56383f0f0a8354a1ecec5fe8115441d95e20744fbffdf908f3b532cb66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3706eae540007479aada261e965c3107

SHA1
eb76a6eaef3fbe2d6dab6292867d7de572eedd3a

SHA256
457319a804802095ba5d1433bff2476f01d308252d2719d5d184607f8f1f225f

SHA512
ee460265b8fcd5fb9e4a92936d306a735e87d46636b44afea3fe417600444b47a5bdf76cbe7018f9d7c1387ad4e4e0788e6d298a2a64c7428adab84140f889b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
77e17cf42110165642b8d78a6d917b21

SHA1
fe8801cb059eff50d12288e247f93f27a22dec61

SHA256
113b0a54aa1565aeb2bba6e3f3482a1d5b3db7eac598808e7cdc4cc7ee9aa946

SHA512
ad49cde9ddd1bacff07b887b29402c7b939900465abf8f7a5236a0277a2ea326edd0c036fa139ec1ca77bd7a3624c18d6b4000e11f2dba55198a5facd2f84181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ba8990d3005cc0ae217c04219f2d7897

SHA1
3bf8963ae9b2486dc16a5842b7d262f509310962

SHA256
3d0d8d0a0f52c760efddbbb71be163a88f1cfae214198d3fefd8d64f3fdb5278

SHA512
e1622fce6916f362c69164892726accbca151f40885f479ce5cd835708e709d7f66d108509358aace6c1c0527f64999122b268475f429c31817477b76cee74da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ce3dcd2019beef106049717983cd8114

SHA1
fec4b8f4ccaafb7a94cafd4c08d443919ff9f8e6

SHA256
f8e0336ed3ea874b50398bdd194c2bdfe8d741bac076a31d93ecbc018ea8c793

SHA512
e19e19e41c40772e66a5ab5c1379f2cfa1f8aff461e19b7bdcc73d356ddb1c4c962cafe8bdc236f08095b00c2e38aed0fab68f3741d0dcc71467e69eb6433ef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e59e3b12c84f267579270c6dd1382968

SHA1
6e0afe68019126c2ca039a3929e07d0cffb6553b

SHA256
d56ebd30bd70472ba01fcfd4c4cdc38fd356285bf975257bdc6dd41f5f2da76d

SHA512
00bb52f32e252dbabcf7daef11f8dde72399f6b735f5621526ac0b84c954fa4798db3f70541cce180b97a7a671683e8bca06485b6d7b8bebd76ff82506e66633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
561e3eb0c28e5cec00978f0987ffc52f

SHA1
8e03e85f52f13d1c68fa37a599c34672daaeaa2d

SHA256
f6d6cc5abd95d3096c945cfa96146a36a9d915f0522a6c2bf4412b5dca0630b6

SHA512
43ae3a54fbf97cbb97d285ab2673873b5dbadf86e49e8145f48361a6eb26d572d0254596de85d85df566581003a79ee9dff4ac4a7ffa182230f01f2de7f1475e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9f791bf8d047dafef95565929d2e264f

SHA1
b1b2da78b0cb26d09dba6ed760c6262242a02ba8

SHA256
a4921c9c02b2d4a5812c8ffe15d4283c6985c25e80dfbcb2ddaefc984dfe393e

SHA512
40c4e4ea3760844b690a7d5e0a3b5fb30612d97ec1dc16dbc547482d2ba74c8d30b94fa477872d8cc80125f154967e1a3554fc59386316a025678697fd6886fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
987a07b978cfe12e4ce45e513ef86619

SHA1
22eec9a9b2e83ad33bedc59e3205f86590b7d40c

SHA256
f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

SHA512
39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
780f6ebae47e05345507693de01451cf

SHA1
3adb4276b9ec29efa89600ef20b8e9e76eb905e6

SHA256
6c11e4c805623837d740fb9a52b7a801fb52d63e32e0ee020daa6d2e74738aae

SHA512
3f449b9a08c0cff44bf9192fb092e038a6411109de1fbb3378271b236d488d3f3a1b36d108f83d298239dc8b1ff026ae7f79bca10b30d67dd8f797fec6acf007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
c4cda5dce9a746ec4c661426ffdcb6b1

SHA1
b7d6c2973a2d8ce97550d1bf256b604afd8af94f

SHA256
fb697e093a53e0146c989a3aba5e867c4e3e12eef647b6ef41733dd8431af306

SHA512
344e921e7b84e15daa3b2d44afdc20d4fc28d245fbdffe8ae9f8ea586d5e601d2441e625702c1f027238334d46e49fd3887978e800fc216ec77cfa515db55706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
abbed82d508ad08757e7a7dfd16eaaaa

SHA1
29f1e671b7f822dc3c66144d39b036afd5b1fbd4

SHA256
5c698b4521c9f3815e176ef5a5776b937b8b9ce260813f1cd20408c9c0962460

SHA512
f385f295da2fbf212dcb5e04070e42ed77878ef95c9735cf82808eac04b1e9d70578fda1c3acbd67065b7ed48a6d7e1cf444be91f82cd1367baf7eac9408a56d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
bf0f3577f159983cb5d472a172ace9b3

SHA1
5d633283bac216ed247d7c9586e1caa315b5e100

SHA256
acca8e6a2f82e5149d3fd5d1830acbb5d3fe2cafe391089bc8ddc9930f502ec4

SHA512
4fd220da08e061b8769f2a7981746cd9ff08abd5db9d878c5c5b675223d4f9ac81cc046150a2d795857372c75490d8bcfcef709a481cb96f2586192116625024

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\AlternateServices.bin

Filesize
8KB

MD5
3ef9c0772f018b885aedc7b62067ff25

SHA1
51cedc048b1a540097dbe5b8cfd972c3c4034fb1

SHA256
2e4b0e399b621bc59ae15bce8513e7db1b5e807b30a5b4564c10dd1c2b0592c7

SHA512
ac5a7ec4221bd07c9769bb02d17e8d28462e2d60f595853df65bca9c935fa522dea800769b110264d77a9d2867e74f3d63f36a566aa158293247b0e8622cb57c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
75459f48f51d0980a2aa241fbe8af6cc

SHA1
4a4509593f08b23717f88df5adb8d288cc495572

SHA256
a50bf8f160e94c039a4aea7c0715fa7888a8d87c0a111098205333fce88d0d6e

SHA512
d6932bc6f536bafbc5c2a8a30123f297a5e185b7ac7efb74cc2d7b1af98de44afc32fc6d899001bf2ef87a07cce05b4d011f0db996e263e5af5abed48986c2df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ac40df27cb8d69e21299bc9ca60fb7cf

SHA1
6dc95c72ad8878f1d01412365b7deb03efa30960

SHA256
ccbe65e8848a0f966698104dcc84dbab00742d0283de94a41675c86948623dc3

SHA512
749d05fdc58eda38fba8bb671e5d2e1fcf3f61d3516c4e1eeb322ef1c8564edcf0ae81195ab8b16f2ff479987f9620c5f2d9bf1b916a049347a6232640c471aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
52cea07c623d5741b985f28adb67caed

SHA1
98b9c85c25162e8113ff17b15edb3a78e9f7ae74

SHA256
4a3f2fb3773738494311bc6ee586e13e720840cf21c312aa3f3a028f84a3d488

SHA512
04bd4b25581d1dda5fb611ee7df8211740f449a839b089f9d0ab5a11846737130a1848a04392ab821d4e6a1d5d825ac39bd4eebab7d036b3c86071827c535c1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\52a72883-3a12-4907-bd58-9b1c3df3ac0b

Filesize
671B

MD5
c1f465dd65ee9b069de31fb2656b8afb

SHA1
8a7cff6920f4684b7f3541a1f2816b8a82e97364

SHA256
66fd3e4f85ff672a56224cf26a2ee15e967d4dbc407134118189ea7ff1212c24

SHA512
78e113d0501707d3b406dccbd81bd8eede0b0391d4ce389118cf60682b906ced9c0a1e2269bb92a339e7898f574d5b6134cd0373d7c1ffcf338c1f7139ba524d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\c9492b16-50d8-4597-9f47-74a017e7ec01

Filesize
27KB

MD5
55843e64fe49cb77a0dbfa486fcc89c9

SHA1
33b726ba80adf67e2bbd9c93079fdc57dba01309

SHA256
b07c8d3061c7011a05bb01610bf653231bf4976cb13cfa692861790ff87f5cbe

SHA512
55e93cf6218a00edbf600e4fbcd00c9ff9a8c95e0e0d58867bfb487e31fca0c0fccafa0ffcbab7245ebceabf76396519b40374a1ef51de944bf22441c19e45e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\datareporting\glean\pending_pings\d05b7678-71d9-42e6-bc59-43f03b717eb1

Filesize
982B

MD5
98891eef91e884267bf57a062862d8c0

SHA1
ce7ed7ad99f6465920839ffba59c16b1f44ee3b8

SHA256
563f47447b56362b08874ebcf6ba1e8f06fa1f4fbbb7ded5d382fb1ba3718cd5

SHA512
2092174061bcdc667c831bc754d82554251e92c604fb4fbb400203b36225174ac23b397bf6800333fe9f5621e0ecda9963d3e712959ed30b34a6f421989813ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

Filesize
11KB

MD5
e435b287183ba5555afeb27cd89abce3

SHA1
88a4134432ce8f25ba718bc4a110643b29718b9c

SHA256
cce5e1d839e8fa511e3945d9f6fac532da312246f4a8c6b3ecc30fbb1c8b13a4

SHA512
7ea2919cd34c42a6a6607bcfd9a21fb8c69e4d45d54f3b818646906f006e6ef77eb57a6900765f716a88f6ce033f6a7286c97ceb20591834457f636093146e4b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

Filesize
12KB

MD5
292a393cd5face8dea1c6f17794f9fe3

SHA1
5c2780c90c8804496cef1111728c0fa6879a3eb3

SHA256
92ad400e7792630ee51b6f0f958ed933b5c81b5aca9bffa8bec338597f4cabf8

SHA512
eeaea5195ae59d4c68499d3fc6d683ec22b0051289b2bfea97aac771c8c6d799a29b9883908d12f7523c2587130ad26ac91b8abf17c4da0dc661ea8e50522206

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs-1.js

Filesize
12KB

MD5
183cfef822fea15c2b5c7a4b9e15fac1

SHA1
41b52972714661d1de1c49cd5a4abffcf95c1e50

SHA256
23d3ce344d9eb7e7a951455fdf00d8d67df3cf41b4b0410e1275ddb422478981

SHA512
7c65afb8d7940d995346cc6fb88631f8a36a0ac5b778f6b1f9af75da71b7cb786fbefdc96910cdcbb415ae920b0232af3818282a10a3e0c3c917c2f8675834ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\prefs.js

Filesize
8KB

MD5
28b1f52a042acae41c67235abfbe0f71

SHA1
383fcf7b8ba28a8a154db53828388246e116f7ac

SHA256
f9b8d8d1361f34da7616f056a9f69399f1788dec5163988128aad9e85c56c54d

SHA512
c08950e0ee889a1a4bfee35edc5b99134aefaeff8ed0d4dd7dffcfed4bd244662e6198b222e83956004d2e1a492632a1c2edda2355b3640da9e7d2bf6310c527

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
c8bb6016f53be35c2a0af548631bf647

SHA1
0effc90b5e38416596b39dc781f6a4a76c944800

SHA256
bb58765f66a3dcf4fa7444174a19287e2af8ee3df127679227cd1f50d4733f3a

SHA512
9d1e6d026573a388885bd2a239bc062ec79576a9b8ea4ddceffa9bfd685b2546d777e6a1b2ef1ab076703732cff0f30b603cfdf4592666589e4e284a36516665

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
5a32e692f53525b4f6a85507a024be4a

SHA1
ff88ea0173bb32a6772923c0ae420a44bfb7237a

SHA256
fc32dde773df0e948d70f91e68faad7d3bb8f1e620ce6f8c222867d5d265e8aa

SHA512
cb75512bb93fea67b8a798d2a8558cd63e10b907c7a55abff9fc07f2145bbad69935364f4f1c0ca75446b68a6286ad76bc52d761f2e7397881e615c74d8b0e36

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
18717a5964afd45d8bb897cbdd474d4f

SHA1
c23c280df1958dc6f12d68e8bcdb18f30a693540

SHA256
530fba41cb853e675de22f0d7cb0509e111b27ea831ad3e408df592771d41288

SHA512
f15d93b667e71e82bc5ee6ea2e8da4db138505427b1e89067114a5cc6c2cff989e38f5696a4558d82b1a18095b069d2f9146fba4540f049d7fd9893ec11aa022

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
ebfb8d532d0acd18fc6d6d46ab5577b8

SHA1
fa30914bc096e0ee61eb5406f9e5100b60289e09

SHA256
d6f103c0a25bf7cfe496d8b1256c69fef19dde95824b47e0721982b30c970f8f

SHA512
aba933c9a70c168020869cbfc18490f350263fdd6b6f15b692cfe899b39a9041f2b9ad42f8e1876fde8f53f4059a66c622ecef82f82a75378a119b84da6d1d1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5n0dnl6r.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
d3dfd8d2692eefe1d93947ff0a27bb8e

SHA1
0b0f0ef5d6bcd24ac94d666141f03cc0fa92d90c

SHA256
086ec882923758e9a9b033595bd38f215f2c9ef225a601d9468ff3c875fe5e44

SHA512
fffbabecf1098aca8ccf5fbe56c5982b382d2fc21dc6e060d85727be258a1b516e2138254e41e5f0194615f147d7cd793ffed65dbbf71b4c50d9841ea2c8a006

Download Submit
memory/408-1201-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1205-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1204-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1200-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1202-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1203-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1218-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/408-1219-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1221-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1222-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1223-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1224-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1225-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1227-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1230-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1229-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1228-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1226-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1232-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1235-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1237-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1238-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1240-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1239-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1241-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1242-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1243-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1244-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1245-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1246-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1247-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1248-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/408-1249-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1256-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1255-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1254-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1260-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1259-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1258-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1253-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1252-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1251-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1250-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1262-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1268-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1267-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1266-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1265-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1264-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1272-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1274-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1273-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1275-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1276-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1277-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1278-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1279-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download
memory/408-1280-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1281-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1282-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1283-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/408-1199-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1198-0x0000000009680000-0x0000000009690000-memory.dmp

Filesize
64KB

Download
memory/408-1197-0x0000000007480000-0x0000000007490000-memory.dmp

Filesize
64KB

Download