faca9623e7841c5634c17b56fa17d50a3c86eb9d2302b418563e3d26601343d3

Analysis

max time kernel
834s
max time network
847s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 23:00

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

_five-nuker-contents-dir/api-ms-win-core-string-l1-1-0.dll
Size

14KB
MD5

55dd5d552a9c827c7292aa17f3a14c5d
SHA1

369d81577e811ef8c0a61b47ef32ffc02aa2185c
SHA256

909f4badb60ff1951243f334cb7410318c4772833d3a996dbda07968cd7e36f4
SHA512

fd60feb5538158563f8f2f6b8d37c76c967e052c90b1bd7adfa766c4057fede46f27dc43c5c4c6b97fc2cfc1ed774995331ee4729c19c0d7d7d474551d33c5f9
SSDEEP

384:uyMvQW2hWXZSf+VIYi+vnCAM+o/8E9VF0Ny2r1x:uyMv07/Yi+PCAMxkEav

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
178	raw.githubusercontent.com
191	discord.com
239	pastebin.com
769	discord.com
187	raw.githubusercontent.com
772	discord.com
792	raw.githubusercontent.com
793	raw.githubusercontent.com
796	discord.com
175	raw.githubusercontent.com
194	discord.com
215	discord.com
770	discord.com
774	discord.com
788	discord.com
791	discord.com
797	raw.githubusercontent.com
220	discord.com
758	discord.com
764	discord.com
773	discord.com
780	raw.githubusercontent.com
787	raw.githubusercontent.com
811	discord.com
176	raw.githubusercontent.com
177	raw.githubusercontent.com
781	discord.com
798	raw.githubusercontent.com
804	discord.com
207	discord.com
582	discord.com
750	raw.githubusercontent.com
786	raw.githubusercontent.com
806	discord.com
807	discord.com
192	discord.com
198	discord.com
240	pastebin.com
754	discord.com
755	discord.com
765	discord.com
790	raw.githubusercontent.com
802	raw.githubusercontent.com
809	discord.com
188	raw.githubusercontent.com
762	discord.com
768	discord.com
782	discord.com
784	raw.githubusercontent.com
814	discord.com
183	raw.githubusercontent.com
756	discord.com
767	discord.com
189	discord.com
757	discord.com
777	raw.githubusercontent.com
778	discord.com
805	discord.com
812	discord.com
174	raw.githubusercontent.com
238	pastebin.com
751	discord.com
763	discord.com
776	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{D0E87CAB-AD3F-4098-A919-627E07463294}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\.json\ = "json_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\ꏃ柠㼀蠀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\ꏃ柠㼀蠀\ = "json_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{2FF2ACDE-5AE7-4C11-AA90-B82C7D70A000}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-656926755-4116854191-210765258-1000\{5D969FBC-ECCA-4D22-9B0B-A8D197A911D3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\.json	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\json_auto_file\shell	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5348	NOTEPAD.EXE
7052	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5776	msedge.exe
5776	msedge.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
1100	msedge.exe
1100	msedge.exe
5728	msedge.exe
5728	msedge.exe
5756	msedge.exe
5756	msedge.exe
5336	msedge.exe
5336	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
3276	msedge.exe
3276	msedge.exe
6160	msedge.exe
6160	msedge.exe
5064	msedge.exe
5064	msedge.exe
6976	msedge.exe
6976	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1052	OpenWith.exe
6912	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5728	msedge.exe
5728	msedge.exe
5728	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	5196	taskmgr.exe
Token: SeSystemProfilePrivilege	5196	taskmgr.exe
Token: SeCreateGlobalPrivilege	5196	taskmgr.exe
Token: 33	5196	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5196	taskmgr.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe
Token: SeDebugPrivilege	3504	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
5196	taskmgr.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
3504	firefox.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
1052	OpenWith.exe
6912	OpenWith.exe
6912	OpenWith.exe
6912	OpenWith.exe
6912	OpenWith.exe
6912	OpenWith.exe
6912	OpenWith.exe
6912	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 4992 wrote to memory of 3504	4992	firefox.exe	90
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 4292	3504	firefox.exe	91
PID 3504 wrote to memory of 2776	3504	firefox.exe	92
PID 3504 wrote to memory of 2776	3504	firefox.exe	92
PID 3504 wrote to memory of 2776	3504	firefox.exe	92
PID 3504 wrote to memory of 2776	3504	firefox.exe	92
PID 3504 wrote to memory of 2776	3504	firefox.exe	92
PID 3504 wrote to memory of 2776	3504	firefox.exe	92
PID 3504 wrote to memory of 2776	3504	firefox.exe	92
PID 3504 wrote to memory of 2776	3504	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_five-nuker-contents-dir\api-ms-win-core-string-l1-1-0.dll,#1
1⤵
PID:1520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23602 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0154d32f-d615-49c4-a875-7a2add423c5e} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" gpu
    3⤵
    PID:4292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2372 -prefsLen 23638 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b376865e-d4e7-48b1-91a4-89f47c3ecd75} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" socket
    3⤵
    PID:2776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1404 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 2824 -prefsLen 23779 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {801ebf9c-0d07-469f-be26-883c20a776e2} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:4900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2756 -childID 2 -isForBrowser -prefsHandle 3748 -prefMapHandle 3744 -prefsLen 29012 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f87cc810-8d32-4e35-ad28-6b1a7f6ce312} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:2680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4840 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4832 -prefMapHandle 4828 -prefsLen 29012 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44446e21-a65a-4ebe-a98a-75908734d3c1} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" utility
    3⤵
    - Checks processor information in registry
    PID:904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5312 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5352 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca0bd106-9687-43e7-8bc9-4ad49d1ed095} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5500 -prefMapHandle 5504 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {219517c9-9b20-42cb-b30c-2e696f428f08} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:3240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5684 -childID 5 -isForBrowser -prefsHandle 5692 -prefMapHandle 5696 -prefsLen 26989 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9785991-130a-4db7-904c-647505ee9498} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6120 -childID 6 -isForBrowser -prefsHandle 6132 -prefMapHandle 6108 -prefsLen 27998 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e98fc1b0-39fe-4ccd-b845-9ad30d1f13b5} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6672 -childID 7 -isForBrowser -prefsHandle 6664 -prefMapHandle 6660 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c14912a-eb5d-486f-a9e3-d6c67b1f8c6d} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:1276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6892 -parentBuildID 20240401114208 -prefsHandle 6884 -prefMapHandle 6876 -prefsLen 30950 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9582389e-0dcd-4575-9985-4073f5bec61c} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" rdd
    3⤵
    PID:3604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7408 -childID 8 -isForBrowser -prefsHandle 7424 -prefMapHandle 7420 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e48309a4-d159-40dd-a4d7-c4c5ebb54e14} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7544 -childID 9 -isForBrowser -prefsHandle 7624 -prefMapHandle 7620 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9805f15d-5092-4862-8d99-9c33c8ccf246} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7524 -childID 10 -isForBrowser -prefsHandle 7772 -prefMapHandle 7780 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22b0cde4-4705-4469-8b1b-47d172bbf3a5} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7596 -childID 11 -isForBrowser -prefsHandle 6128 -prefMapHandle 6076 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a003dcb3-409c-47b8-8db2-529b9e647386} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5848 -childID 12 -isForBrowser -prefsHandle 7256 -prefMapHandle 5672 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2b630c1-6f2c-48f6-a999-4ed8373c9c8d} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7564 -childID 13 -isForBrowser -prefsHandle 8096 -prefMapHandle 8092 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {375b48bb-950d-4c0f-a6f7-292acc692682} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8372 -childID 14 -isForBrowser -prefsHandle 8300 -prefMapHandle 8304 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {941e7bea-c0a2-4274-a4a7-ed56860f4ae6} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8508 -childID 15 -isForBrowser -prefsHandle 8428 -prefMapHandle 8432 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {945923bf-5dc0-4a59-b070-bd28c3b85d78} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8480 -childID 16 -isForBrowser -prefsHandle 8500 -prefMapHandle 8488 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27f67882-0df2-496b-a6ac-132643a1cf3d} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8768 -childID 17 -isForBrowser -prefsHandle 8716 -prefMapHandle 8756 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9891a487-9175-42de-a2d6-f9deb152506a} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8832 -childID 18 -isForBrowser -prefsHandle 8480 -prefMapHandle 8488 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f1127df-37f1-4bbb-9990-e7544e5ce712} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:4548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9168 -childID 19 -isForBrowser -prefsHandle 9084 -prefMapHandle 9088 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07ac7f8b-6531-40b8-8e02-3d2b96ea759c} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:1840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9060 -childID 20 -isForBrowser -prefsHandle 8856 -prefMapHandle 8844 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2914098a-5ef3-401c-ada2-b37c329c5223} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:6976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8932 -childID 21 -isForBrowser -prefsHandle 8896 -prefMapHandle 8920 -prefsLen 28282 -prefMapSize 244628 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc4ddb6c-5a71-4b39-a11d-ba8c38402aad} 3504 "\\.\pipe\gecko-crash-server-pipe.3504" tab
    3⤵
    PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8e0a6004h6b22h4918h8b49ha2a79503f996
1⤵
PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8417046f8,0x7ff841704708,0x7ff841704718
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6052293223606879658,3311261570818959619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6052293223606879658,3311261570818959619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6052293223606879658,3311261570818959619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:5848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6068

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5196

C:\Users\Admin\Desktop\lol\Five-nuker.exe
"C:\Users\Admin\Desktop\lol\Five-nuker.exe"
1⤵
PID:668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Five-Nuker
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:5356

C:\Users\Admin\Desktop\lol\Five-nuker.exe
"C:\Users\Admin\Desktop\lol\Five-nuker.exe"
1⤵
PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Five-Nuker
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/QTDXqt8PA8
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xb0,0x104,0x7ff8417046f8,0x7ff841704708,0x7ff841704718
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:1292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3520 /prefetch:8
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2020,5138267628068668102,5085731006256914382,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3548 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:5828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Users\Admin\Desktop\lol\Five-nuker.exe
"C:\Users\Admin\Desktop\lol\Five-nuker.exe"
1⤵
PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Five-Nuker
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/QTDXqt8PA8
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x40,0x7ff8417046f8,0x7ff841704708,0x7ff841704718
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3516 /prefetch:8
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,17785751075410778715,2563519126244939129,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4060 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:5372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1052
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\lol\cfg\config.json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5348

C:\Users\Admin\Desktop\lol\Five-nuker.exe
"C:\Users\Admin\Desktop\lol\Five-nuker.exe"
1⤵
PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Five-Nuker
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/QTDXqt8PA8
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8417046f8,0x7ff841704708,0x7ff841704718
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:6208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:6424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
    3⤵
    PID:6672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3500 /prefetch:8
    3⤵
    PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,16144130537459831368,13759020465688304936,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3640 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:6976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6664

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6912
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\lol\cfg\config.json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:7052

C:\Users\Admin\Desktop\lol\Five-nuker.exe
"C:\Users\Admin\Desktop\lol\Five-nuker.exe"
1⤵
PID:5352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c
  2⤵
  PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Five-Nuker
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
  2⤵
  PID:540
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=728"
  2⤵
  PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:4456
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=720"
  2⤵
  PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:6692
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=836"
  2⤵
  PID:5748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:7148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:1504
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=960"
  2⤵
  PID:228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:6364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:6372
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=964"
  2⤵
  PID:7120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:7016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:6488
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=976"
  2⤵
  PID:2700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:6480
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=984"
  2⤵
  PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:7128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:6828
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=992"
  2⤵
  PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:7036
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1000"
  2⤵
  PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:7012
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1008"
  2⤵
  PID:6184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:1324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:5492
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1016"
  2⤵
  PID:5296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:4456
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=620"
  2⤵
  PID:6196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:6612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:376
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1032"
  2⤵
  PID:6264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:5168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:2736
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1040"
  2⤵
  PID:6256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:6848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:5496
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1048"
  2⤵
  PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:6460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:7148
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1056"
  2⤵
  PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:612
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1064"
  2⤵
  PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:4804
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1072"
  2⤵
  PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:6400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:632
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1080"
  2⤵
  PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:7064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:7060
- C:\Users\Admin\Desktop\lol\Five-nuker.exe
  "C:\Users\Admin\Desktop\lol\Five-nuker.exe" "--multiprocessing-fork" "parent_pid=5352" "pipe_handle=1088"
  2⤵
  PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:3508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five-Nuker
    3⤵
    PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Five Nuker - Online - gli africani che esplodono#6728 -
    3⤵
    PID:7040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2fa38702a06f2c277f47288703904b65

SHA1
c2c1f3feae4aaade85f1c712aa652e34af74c97a

SHA256
cbe73e1d91243a07cf5790e4134ac6249a9fa69790c86e42b4f854136f54b362

SHA512
3e6b083d935c63f332c44ebb7a86aaf0cf87f78b166404a54350c3b53f79efe75f192c73ec1818fb8c577323b71e9c3b328c142924a93ba33701dcf85505f83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa56a4c230ba9c41b8aed6ce11889c2c

SHA1
37752b28407a087a5a753f730b6b9f8ff2033906

SHA256
290ed6ef66b3125d3a62c878cc657a593ec4eb9ff785658e3c2c22de7e39cc3a

SHA512
2c680d18da115e512a45c864a735ab58ed9dc55c5185765030c86bd5e9b9dace55eced24f7386c21584867d42de67fdb2d0927def31ee397a58e244eb87f3575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fb471beba75e7014be735d0a58f86752

SHA1
6109797fdb66c978f27e1be147938054e2e56b5a

SHA256
1b9e9f134f473f6e4e2294a784b1960a6b8448ce4a1f3258316c9cd4aab2a7f1

SHA512
add70b510fbcbb26c1e1b0328c56446cd621876586697f78dfbb9855fc55296a601dadecd8572a02d49cd9ae57a022dc09ae40768af9925a162efa87336fc0c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12ff69fa-bbd0-4b99-b8de-4b71787b5647.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
669ea9c77afa155ff346ec8e53f70987

SHA1
66d9ebe0ee99718bb6b84e7c34a435bdf7ccae7a

SHA256
23adfe0c4a914642d86764ced0a5f50b2c655505dcbf434094ff9e701311db3d

SHA512
aec7ff6abe3d2d497ab0af6d88354f9ef83900c5449cb068b07fb11972f28c9b6f4b80d0005f837415ce98ce33b28eca64e59bbf7672df3ffc16d0d92808e78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
f50e355c4c52883d9111c544f0370cd6

SHA1
3db858c19d7b25b990acec8b5cdfde902a8cb62f

SHA256
cfbddb15dba40299aeb6a0a6d9e6f8dd86fe624fdd3041265aae3cdf2d9dbc5e

SHA512
7cbfbb46ac6ec61178c7bbb26d7f7809e445014879049cc1a0da9243b5b4257fa4ea6ccbce72b36303a66261649c66fd5254a17484a6e6aea17c948711216e44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
92a658c06b108129d167a6a152dcb4cc

SHA1
5856a35e215b130d307cff5037898a04100e3532

SHA256
2a60bf72f5ff7ed2cb58a3b42da49470e97078284358fb24a35ffe287a4634de

SHA512
cc709569a7c3849edbdc3b7ff880035bdb6f959c18808394677a4aab12b45ee9c4225a11caaafec812b2c08bd92948463ab81403bed32940e8377cb8e63fc8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
663675eeb7dd47cb666b2d025676e0d2

SHA1
08b95d6bc392090851de5b58693dd0e9030d99b1

SHA256
86f3200676ffd1e2ae0d80a3d58e097cfdfed971d6776319b42954535dc70673

SHA512
cbf4f30bde298aa5211ce335a7c309d483c10a5c45294f7a8dc6fabc7c9498f61aed01a9454099eea9509f8e5b57ed525e29cdeacf464f52975773c15bec2081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
1ba676d0c75252903834ef60593d0845

SHA1
aaf01e69057dd5741b53d4855620cc13fe8a5f18

SHA256
244fe4846315a72eb720d16338479bad521159f05021572653b0c6a7feac955a

SHA512
6145f124cd253742b083764d484bbe5e6a0eecdb1306d09dd49f850dbda43bf7b4eda328c23d4a2a7d216beb195f635578e27e2b5685cfff0f2d497d843e4e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
9f0944fde7bf35f15a7a590c40b0f2eb

SHA1
18f613dffe04b74f3b4f235480dd2ef58bb55cfa

SHA256
76dd12aa4cbbc92ee4ba604c363e3de66c889987622b71ffbc64eb2725edb2fc

SHA512
f2e500ac3158e5709e3028c59ec04e3c7feb1ed4aee73b61e5eb279fa695c5a072de5fd30a9c114001ad09b9ffc919a8b570e2f467be60da022655f00cd188f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
3b3cec7f4507ceb01619bdbc3bb987cb

SHA1
81e8caf7b96dcab00fb749ef86bcd38c84dd7a01

SHA256
cdb5eec6cc2ebc694486beb47b6b9c462dc8d5e42393b8f945a32b43870ae343

SHA512
b7758d123d6c72162da824e718c02024ceab3eb138310af286469a68346eb5edafe207ab669beb81bdc819a5a58364ee39fb5dcfab63cd2820f97c23a1fa0a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
702b9aa5edb5c606e23978889548edfa

SHA1
df918caf5514cb2d66b28ae6b8f4a645c2d85c46

SHA256
44af254331fa218c5be190cb9e535336f27e6675c1f65a4dd8f96f82d53c0062

SHA512
1ed8cbf81ef5c7e5ba6138060bae18281da2525c723d90c6bca95e2bc750c324f784330cdab25ac2716e0fba5ee5ff84f1bee2c7c27502231cef8975bfc86c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
713ab98d0714eb7f862f0a84a7a8c695

SHA1
cda91a4310f0abbd4fddb8eaab412c6530945417

SHA256
a331ec0568f469be94b049ac3c23fd8c7ce017a4501935878ef2c54c1b4165bd

SHA512
a3c69a588912dbf76446da4a379068dc2ee4734eebaf15cde21a0e3fa769629a0fb1786b1eedd0a8147f5765e44053087c6732c9d39355f08a7eb87d227c3fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
322B

MD5
21842a9b8c54707907ae31799765c0b4

SHA1
1af32900a25242d56f236d131bcf0f2ed3df4559

SHA256
8b36b47a105fb5eb58ec41940607edb6df9c81b599659381a80a3eae8dc5d21e

SHA512
9cac82ee0279d94a96c621bd4618f454c4266607aa8682ec5c14233a1caa9ac3612f4de3dcd3d85a047cd9258ee0bb4b6b9bb29ec216f4345aa6b64b4ed5fa75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
1d008bf3655c2947a525a8db7205299a

SHA1
79ded77d6049801c40e4ee535c212ad83e2381c2

SHA256
60703c88d0c5442b08464042feb31cbe8279771af40fbf430030bef1132c8483

SHA512
7212d313b1ca55447657258f4dbc9ae87f2edd45f3dc4a46c9893eb5de843d2bd329296cd1338e41125b0b2ce7ad0ead77326ede1cd53ce56754fb87e75fd447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
63abeca03f30766e0b0b430a151d6696

SHA1
6249559f71e9183ec9406db533a7cd5a5df499fc

SHA256
989868d96fb2c216206a5465d2beaaa69144f68294a2f0aa5825f0019d6ad39c

SHA512
2efd36f599188b7587f82fa050ece68946551bef879115650532f8bf69205ed002e7fe669fd3eb30a7bbb0a60b6c96663f4e2d629639c6e6729c24d232b646a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
565B

MD5
5f36d1296273942e4a2726dfd171ec62

SHA1
7dcec220c8c664f12c5fbfdfe228ad8f69f53df2

SHA256
d31d4d79a5b85f0da2ac61c608ce6e82aa7e41504d0aa94843a0dbd9e90fff07

SHA512
029ab3751fbae8bda2a8f1ac1298b5d1591588d1d1a9997c0d1b4f2c06cbb746dc53ec969c4719c8624ebf70adcf9767c380df7c0cac6bed0b2f45aee5febd4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
20KB

MD5
2e66c89fac6189f4c352496dc5a5a71f

SHA1
16c93f93a442818b5472e9b422b18c1f80f6c187

SHA256
7dcba873d133eb620a26fdac98ec07f628e01267efd0ad1785e446932588e769

SHA512
e0213c969d3b9bfe6ba4b29328d684ee9f724c4244e59974a0b99fc2c632f7f1513827e871637ffb8d1959d9cc68bcabbe44313fc30e8de694c000b82c621b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
4KB

MD5
ae92915420b05bd19db7f851a6fec518

SHA1
f4b5fdfa93a01cafe441744aa5e765c123ba9b9f

SHA256
04af9ba7356e39dd75f2ab372ec19f3411f788ebe751875daa3e172c28063491

SHA512
cf4ea00c4b76ca756924062bbfca8a1b4a78123d8f241d56d7997f67b7d5702918deb8c316571914b6565980abd3377d9670eae43ddb62f8a34b8dbca07ea758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
cd090fde42836bdcf3361d790f40a29a

SHA1
7ceaf9c4199d9d702e59cbaf777713858d74a037

SHA256
54c403473af2cf9e935dbaa827aafb53bd72ede0b6dd608f541bd3c0385bd98f

SHA512
05350b58eebcc1310eecf0e7cc749d96439e78c3e576ca4536a9d041d5d1086744f1a04904f91ace8370e2fa653a322a8f759635409d3b4e5376da36e87f9f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
8a1d47ddb5235f4f566c928aa6a4e8a4

SHA1
24292cb3f0578f60f57ab6a6854e1c99041df91b

SHA256
84587eb2e284edff4b1ea187d81feadfd4425a6a9caa187189b111debbc21459

SHA512
77473910853b1a399147a22680434617933f064abe750cad46e6f117b9a32e56483b467c6f80912d4843ecf4c8525c94169531c4a75c8114fb93d85254d08702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
323B

MD5
a5a1149047729a493b1a2a65063c39ba

SHA1
8f1f45cb0c0772dcd05795734cbf408636fb9fb9

SHA256
e0ef1f906ea2606c802310437fe799d93e073770ab6549060ee4b9c9c49f2006

SHA512
8ce257a087115e2d542657a2b4679d0c100ebdec76e3392cff1bbba133e129f2fcdbd73f9baab92e762bef47a2572d3dc8553fa3858d787d2a0b2bf8f05dc54e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
531B

MD5
b88401e2ccea4295c5539e4346aa9f0e

SHA1
5662bb32ea0d822bbb0318f00f7ff6618bfa69ea

SHA256
91313e96fde3988887d22b1b644dc359683931650c5a2aa2ee5418f389bacf18

SHA512
449bbe8cab6247a9715dad2fb6d8597d25e9b774e0805c39b4e32064219768ec8bf9afdb4d2d6cb73aa55b245f10f58778c534936fd739d1eeeb6dd637a612ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
531B

MD5
14331afaa78ca24622d2d304467943e9

SHA1
3018f803fbcac157d2b9b8a8d88046c813fdff1b

SHA256
fc56b9cb61ca5f45a16a1ced79aea38df15d389e03b8a488e754056739e8cf97

SHA512
7abaa74a07cfa6d129397a1b728ac4a409de161149456b113f6456a4b48fd6b807996c2d4f90332ae0bec8967c4ce68621b941db367f929f2c6f176821d5bca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cb7553dde3178a945b157b97044ebf9a

SHA1
e5148b7e6e67a311d6f50984d898c58d5a36f2a5

SHA256
beba40046a4da10f94c1433bcc2d4ad5c447886238ffdb466d804b451614b86c

SHA512
0fbd243e476d4c009475ca6e1942e525f22c72eb1bd204dd56c8e1a871dabd41a5cacdd3c1fcff756850b6ff219a3078fa2bda75c16bead5ac089db04a2f56ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab7daedb078f9140f5d89a216ebf5ed9

SHA1
6a1bd87460eccf629528906ff6213c8da3d61b95

SHA256
7e76e977cd4ec5e8fc6b16a08d2d767e12b7ca093f123cfcbfd83b8959eaf741

SHA512
43ac60746c7c21af684a0817d3e08baa6d4aa807ae6b4a734548987ad79b15a4e0e7b2aae848c95c131470f4df8c9a3b118cf2a45bb5e4d8cf032624aa3d9160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac0421d4857708d33762f7cf715881c5

SHA1
e4b37c077fd8c85ba5c28e7916b002e2caf395ac

SHA256
79165eaca7749478debd9a119962fcb62cca25e474a3c1ab6775e8cbb344539b

SHA512
7884876db6fd9d3b12558e4293b64df7deceb07649dc6132d280eac6c675670f32f0e70bb55ccf1b82c929116a3f653f97b925b4fb484e8a87217495cd494fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eed2049948ef85a3c0056906e87ada1d

SHA1
814e2020a65b8f5d10b85091dba6384d1c65218a

SHA256
cad72bfb3602a01b58fad2323b6b3a1549ea955eed2dee035c711043efd461ab

SHA512
e800e9ebf8d09cbbfbfd97be383de2ff7c8b56617a4bacb6f6f0d52cc3ea8d33466b18055cbfb136f41f10ddb791fdffa7fbdc52ffd13ce29db3ff339a321773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
680c5bdfeb051eef020718d772c468e7

SHA1
3919e8909a2e7f57968bf9a2d947d43d2af4b207

SHA256
af7c1eeede8ea09ecae39bf2dafd33abc891bf71dbb0d3f319ffd0932003721b

SHA512
49089d8b7b21f74e8e21af2f1304ab4735431bd0fde2eef961b04ecfa9b155abfe8db6a7ccb623101eb69724a030d7f8356c62e424d2559832d7afdd834272fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c60b0791a673d3348831fa8a1ea5fcc

SHA1
0722c50d4f73e644165a26f0e2c889ccb402772b

SHA256
232fe23d2ddedd45a8590e7bbb294e34f7d28b8f4c6cb79f30b3c763a764fe7b

SHA512
16da90a8f46fd4d7484893b6ba4e9064bd0b1925b1f2abb765134497c32a05d426a23828fb48f6578e06d178f18dbdc83c3bbaf446490e8b879ba111995cdf89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b512aabe1d4e13724d1f4b024257db62

SHA1
4a76ca64dc7782c6a17e750ebb53c700e5dd1ea5

SHA256
12340c476a831f5b6652d230609ce25e461a2ffe716332233b6216c175d92bba

SHA512
4e269a5e35874be620557a0c5b31253477cd8083da2b3edfa651eeee959cbf983c44e44217ed1dbcb1dc736cf10597093873057d4b57234bba4083bd3d8fe381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
501B

MD5
d51333d31d50bc8259d4930942f2c3b0

SHA1
386d622b8a0c9177a48a7757ee7d562ce2ad1a97

SHA256
70aec683478d923c8af3962b9b595330c6cf0671576591898438ac23f8d4cd1c

SHA512
ed89ac1c621cb727d2661be25d2e3300a871b25601e6a17d1bc1c049e02f85ab4e7595252f52cabf32eb5d30475b3a1d0597b1e6927d5c54477f21bdad4e9b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
8030216c5e42996dea4d7033199ef312

SHA1
acffa700571f430ceb2885f0a68c2267d7124601

SHA256
8c8cf7b79b91c71fbce74fa14051daf4273b35596ea5745434bf37923e5d5abf

SHA512
ba81558b227faa4c3ed1532dcfd7fa898c94667ffa003bcf1bd08ca0c2c86cf816138983711f5f4350ce84ebcd8473d1d8e9a0c0d9c7bb430c50a8ebbe7a6fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13367545392427810

Filesize
2KB

MD5
55d390f3335a5801fbe34efb80b3fc39

SHA1
5df1eb7d33d93578ed844da125335fe749847b8f

SHA256
b29272e6c874f2e6e72be9ba57c4a4a8e0c389214bbcd6d1963086fffe4bff32

SHA512
0047f309ebc956ce1169b056f330479041161ac03531a71561388758e1fa26bd2ad790f34f46e9235caf732ab045be0dd005fb598c663fb9ecf6bdccda57dfee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
f73ae1d62754a526b2d5c8eeeb21ca15

SHA1
fe9eeff705e9042163d1081ee9a3ed2a1f495df6

SHA256
c29c8e4399968668ad22796088a138aedc327e7c927f339add0571b283625d2e

SHA512
2cf2a2c8db807081d9ed8ef97d0336d72f0b69877450ebfa8109dbf3e197d6828b5fe8d5aaee29315fac9666d316e2cefa3a17dc21270b2b79202c4b361eb5bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
bf80b226536e9bda307203fd0ad9798b

SHA1
046a70a0a431618435a39ab16b73bb22f51491ce

SHA256
fb1f08d30df9ff896c353d2d99ac6c76ae10be562f6587767ae3c1faf086339e

SHA512
432fbacba30db3b3ee28b9db4f8673adfc98ac4cda0475eeeb66efe5a35bd9479106cd561ea6683b22ba3e64491d6fdeea948a17d0fe1b689287b88ca62fb141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
4689307c188a06cdcf95b35a5e1c1feb

SHA1
2ba40f64eda3bb1d7db7eabf0ceab1cf3906dba0

SHA256
1b12273054796fcaa2295b49303e1f00dafafd6882815166fcf49b1eb0ea9318

SHA512
95266f30b07ae862f614d7feed4e3195e8edc655352d9869232ee135318fad0fe1b1577b19a56f3115ccbf466056b65c35209635dc103c3124214b2049cbc599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
ad1a1c4ef926f466172c43ec6808f300

SHA1
6fa9ae3943d5508f2858e3955e2677dfaaedbfe7

SHA256
ffcf64938a1e98cb361f7c34147376515c215f7708777f95912f673ba11a8e27

SHA512
e4730fc32d3a7dbe23ef9a2e70989e2758909a3ced13cdaeeb9cace3ade673357b51e04fcf7925f679f20f208c5f5d7265e348a8f806fe3177601cf323e71446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
a634da1c738d133421dcf64b91e45d81

SHA1
26ec3d4e6c90b5c8497cfece9c94a8ca9acb78b0

SHA256
51821ab4ccc6b4cc47c4a2504e23c129e2416f9db8bbda17530747b4fba68fe7

SHA512
ed852a232855b2340a7a44931d2fd0daecc3c5a8b267d9db8a0c25aa8b1f683243d9ee5b461ee95a4b4ff1e84d63cdc0bb14e22d86621523eb1dbd72cb385c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
51b8a86f7257cd4d527c23e5ac9404e1

SHA1
4dbcff038599f00e4f30efccdecab593031466c2

SHA256
84af6e74d22f0ed2fe7ef7027d05327c47d8bf59450592bf41113f5e3f267cfc

SHA512
e8394d5270e1e546330786a6acd541887c4cc09cda463efdb78605f48a526645d727aca1608a23c6e45581d2d8ecc578212978246b79348a03fbb34f5278574d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
09d3260c41d2f98f41549596ae06dda0

SHA1
fa86248468113e1aa6376bed676462ca62bcae8d

SHA256
fbd79a9b5d40532c8e7be20202e57900f24c90cf405a8728a7bcb3671ae8830d

SHA512
4671254e628dd5a0bb5946c4cb9a63ffa7f739b593dc6f54e5ad3eefe952be1e3aa972cf73473d1bb1cdbb731fb9e21b6823be781a7e609e586cdfe1ed4fbafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
2c58d8cfe88a63b55126bc34a9fc2f01

SHA1
82b0a8b22d6824e6aaadec0706434eb83cd5ae97

SHA256
96ed684e49cc77f347e8a343e61a2240d3a8f6a80ca32df86a9583d420a7d921

SHA512
696a65e701367be63e280db6b173fbf1be34510e434afd2f60b5ae74b6e155bfbaee066854d9fa41055f508e888d3f1e7abc25c2235bea541ffa60e6d2feadbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
d40abc0a156e12515cfe19987acebecb

SHA1
a51340417341bf24523d4ec3e9e0e866bb0a5642

SHA256
e245d54baf2fd4a9bb3d1f9e1788f39d68e1fca33d4eaf3c16cb1d6c95f1bd1b

SHA512
a61c81ff158f3320fa1efff3e92f26a0b20593529723e54635f1b90806bc50f618040e5e9248b2c588075ce1cd6bbcd7c17e3c6ffd2389b17af29a1d88a19c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
194B

MD5
a48763b50473dbd0a0922258703d673e

SHA1
5a3572629bcdf5586d79823b6ddbf3d9736aa251

SHA256
9bb14ea03c24f4c3543b22a8b4e9d306b926d4950cfcc410808ecac2407409fd

SHA512
536406435e35f8204ce6d3b64850ffb656813aacbc5172af895c16c4f183005d69999c4f48f948875d9837890f290b51a7358ff974fb1efc6ba3d1592426cca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
df5db600672d81af2e40ae27cc660d76

SHA1
44712f2d78d00af01b913695a0ede2d8bd126428

SHA256
afe105ac2e79d6b094ce0af74fc4c3462df268c7315f819a60902e89caa38f11

SHA512
9fc3757d4655e25bbe9bea9144f5dc181032d42b4a986b09a3452ab5b1d10201b2411d565b45766a72ded316ad68003dcc225909714e372316cb94f4370101eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
afad9b256ea7f8f2a3a7ad023280807e

SHA1
ff532ca88ad4f064ff6b300c22c8ddab6a37ad9b

SHA256
351457251d4ded0b544b5337650f5f02638da327cba8e108b7232c9e85a0e860

SHA512
511ebbe34a3ccf31a51136d89e194094a5f440a97b53a3e7445549b344345969e2f497ab2f19cae67d4280f39238e05a01d79a0780363c51a54e98d438a71a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
183f5b247b3ee59237ea48556cb1217b

SHA1
d6a391cd1a25e3fa97a941c8a2680783310b254a

SHA256
f1d4b18dabd515e34466eee8683564b61821cd5a056855c08ed85de1270987ea

SHA512
867c5bf604092ded80c8abaed6458c3e2b47945a1f917d9e29e17381fb3cb896053edbc3105948cdbf90f28a27ef126fbb4dd9197c775a858e4e5ada46fa4b66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
67fad9311cb9372e05a41ccf064976a4

SHA1
43ecb4c2643b334a5a91b273bbace2e5709802a3

SHA256
9b0b477af24ded6135d7d9dc77da9d4d450f3fbf6ac31a4f34248d75219c0098

SHA512
2a93a874017a0ab0e548d39688c012724952d34e46abfe91f5a3736ab761a62ebb661545d700a0ffb6ae87f380ffced347913faca9a61fa8def7c38661c8ecc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000015

Filesize
19KB

MD5
a23cdd3c23881bc62921984b149d44f4

SHA1
022409d277b33739657826ffccc741c16309401a

SHA256
d67ca9845f60702efbbc4478ad7737a872869237921e805dec7806211baf2b05

SHA512
d7a1264274d1ba59b725c8844a55d0c12a5b4d91018b68a52e9ac9830319c0102793582f9449881f076e3038fed25a2421280f696497b4e762f422ed50cb0bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000016

Filesize
16KB

MD5
4fbcae5a3cd964e437e4b598fa928d9c

SHA1
f5f2b91860e1d8847926e0e4dcfd5a7f1a6d84df

SHA256
67454c3a64a18e405b44fe09551d43df949e5084bd9c360bd61f139b92cf3aa8

SHA512
e22f240defe142c2ee75a814777ce93239e873cfec8626708663f151609b17cd57380d9fed297184750127c57232bdd9950c66598be3009c1a9da8ea49cf5962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000017

Filesize
17KB

MD5
37ca5ed57d2b5d45067242615a74b185

SHA1
6e1cf1c4cb12c6aec76213332a3018d68910f750

SHA256
07758f3e0437771357993e5244b11f0c4c03a3ed0c25ce6fdf0df373c58732ff

SHA512
778301a73787e18af16df59c918221fb71eaca3863f724f5042ea0744fed1d8596bb5f77932cfbb630953713b3bc69c27a80f9e9bb453eb8996f312194884e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
7cd192faa6fc5a99c49b278be607f672

SHA1
39b0f6eaa6d14ae159d002dbb3f60f7c3523b49c

SHA256
7918587840932b66693d11b0c005d2e8e514184ce550bd985bdbd59f41412098

SHA512
674b0e66e610bcc22ba61f971d92ffd8237bc17548eff1016d957ec8df0cab96e348a049cf5e1a5c66ca734251b3368a5f0899107f1570ee7113c837dd504a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5686416e4191e98c8a263a3fcf7f8105

SHA1
8329bd4d3d10e49d630f823a2ca1d74851296f5b

SHA256
b75e7a18a603cc9361c4db79fec702523cfbb3695a924b79d8f838b7f7bbf459

SHA512
66bbca5cfc6a4e1cd76c0971ccc85a6007c0ffe0cfb81b8911e8ec9472ec967e392c0fe532c4a7098963109fb22d394c55e9b45d31a1a7f2f6cd6018ab6673f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b3aa73812f23af52b92c87ed000248f5

SHA1
c0b1da1c0926451550acd37b51722fb1a38487b1

SHA256
40deb33ca0dba53b8841d6e63d00b00189abecb570787e8203073c3f306f8dc7

SHA512
167f9100abbbb845eab43381e707a210267e9b69f67479d5ed5695575ea75cc2ae978fab6d16711a54a5a34ad90e574d9d11347cc2a3b608d766f45d5ccf66bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
281d7fc645792cccf55b090402c148f5

SHA1
30ba3590a70d636a326b12f1f6cb519e91669ec4

SHA256
f851186a55b822da32c3533f96197ce888b1b05f8b5b0add5dae2bac3489749f

SHA512
78ea8a2fbe67bca105b58b4346152e151f5123a6324e78bb65342e60b5c726409af9b3eee2971dd629634229da134f0515c87761359526a2c417e02250180db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
c20120f38420114fa04623843eb0630c

SHA1
a25b2d14d49276510a162db2e4ccb27267bb0ecd

SHA256
fdc06fac2a2a4b5911c823061bcf89d971e1a033212ba20f6fec97f1466289cf

SHA512
7f09be9731fa3927ff8954c7256fd625eeb58963f392d09253033f46468a22e99f819587a10af7efc1e68a4f1a9114e342c74b53d87bbfcf6bc77ac611e457e7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
173dbf83fdf4e03df273fa548720765f

SHA1
319998d45ff69ddb83e419dd876691b8e56ce613

SHA256
6546f6d7d576077cc44fb92c64ccae9b4f23fa5a8cac028cb1e38adf8e5d604e

SHA512
fb94eabc7a06134164b5a4e17385a8425bf27e13971cdf3f60d09665bc3c852113e7bb02b2de1d2f8fb96b33ad76b054c15b4dc09adb6a8b3472f4f1a4e9957b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
a4fbe19a8a81b2296af881520e11ef95

SHA1
979040e3d2c761e4a10017f0f80738acfad18e6c

SHA256
a4d07272605cd288dc6e554131f8b91931bb0d9f29dd2a9ec6c3fbe85c96425c

SHA512
183ce100f5527b233b26d1933ebbc183065ab657a6c241971cc976355a5893047dca31a677708c076b44c266aeab80a80aeb44b3a81d892f471c1f925a8e9e4d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5utpapi8.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
c316170fb3531fdc736b333fc3ff1c04

SHA1
27942560663c89765043d0700e9c86ef50f874c3

SHA256
3e734f0065269dd198ed6ed4593818b9940d2f6863853337366fc86586a849be

SHA512
fa7f87143c0131abd35cc6782da2ee816f03ca59551ed60ef2cd766780ff8770132ae7ea507d3589d3af49ea90abbf4469c2da6f3bd936afede1bf2738db1791

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
15KB

MD5
f86503a931090f978c3ea1f944a97793

SHA1
3d0c16b110fca04c1543529c8e75fffe7998df3e

SHA256
1355cd024e248864c44922933a7f8bd2e0fb2ab93452d2eb7ed11b30cd9d0750

SHA512
2f4f71fb4ac5ea0778feb15381ff8db4ccda8ccef40f4f7a73b1a60931ab3a810239254c344cda8d5869af423f11159cc3c288907f1f35ff34c4734392b15419

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
8a109e32f29b85f3a126ee3c228e4c97

SHA1
baff0c5ec2ecc22b0a552b8fb85cf78ebe76bb84

SHA256
65a0d0f829394a644f731ea4e8124b2ed43d29ba3733697318595b7bffa7a21f

SHA512
9a4e76f006ac4a19f4c1881a84424bce118b1f0905853cafb3a6b0099d3b388f477e39aca3dc7b124d64c45c643cf601fd21cabd1cd24d0e78e693fe3f97e997

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

Filesize
11KB

MD5
0a7b13ae36300743c32291a4203d6fc7

SHA1
cdf6b42a9341c17c1e27ebd9611009ed97451a55

SHA256
4a3ee3c7b51f700f31aa50541c69bea7b4be2ae21725a7e8e520e9da19fd4a58

SHA512
10fac7a8a0005e3df4c4edfa86e23212c56ca529f64c0d73d0b5b2b42df1a4f2f26636349d2ec356ce223de9dd4ab4e63f5a841cd9191ac4b4d03b277aea570b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

Filesize
6KB

MD5
3ffcd778eebdbc8c5547ea372910ba65

SHA1
84472426d2f6054905e7181c6de489d49c7cd64a

SHA256
cb92af4e0b4e3f6d6f4e1b2b8c69a8f1cac3ac6b171403e228bf6d9dc4b58716

SHA512
512293ca09f9e0139573e101bbff36d4637a7d629aa87d2d526748ecf65a3534043f7cf4e2c79dbe44d85aee028f0a6fbde634751ee2801d56c6550a3e0987f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\AlternateServices.bin

Filesize
8KB

MD5
f6f8dfa440655716f9a60ab5beee8eb7

SHA1
f6d5e5bdb78fb6a5ec09dd998ec722a095f17cb8

SHA256
1fd28ef0f99ee1daa2ac4e230b09ca01c9588592bd6f9d6b1958a1210c964ee0

SHA512
5eefa191fe872f6eb992b91c22fff1c16336ceb47208793ae8244b9781c1ff52f5314e30b3b03df00ae23d40213be71e96a0e0ba122ca7c82ef11577d2bbb764

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
39KB

MD5
833979b3445b05f3691d99b7406a7410

SHA1
994efec77d5e99cacfcc3f4a212a7931366821f8

SHA256
03339e94a595d6fae6f4fec2670223b1c8b0a81635b0acfef60900fa18bde9b5

SHA512
633d7c45a3a873af9e44702b838177d59c95cea9cc96612041f0b3d6a7d3a10ab5a86333148e85db93c857df9bb7ed41ab2d21150263c276840876db7036d52b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
24dc9a3a96132a59fdcf98485e559cfa

SHA1
05eb332e6d3938f42132f1e3dc66017d4f3e10eb

SHA256
a5d257e83cf09b1b7c8a1a9eb58963a87e4e2051fd34779050ac92e033a96057

SHA512
571b9aef32d159eb1d671550bca9659c5a1f581e57905ee1e256f9290b8450a3b4e324e2405343594610a5148808f246a2ae32843be6eb754b2c7af7091cb014

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
42KB

MD5
55b3135b4cd3fa218e3ba80bb47c4d16

SHA1
290a79e8dfe97962908bb8f46fb8a8a04023fc23

SHA256
98f408366380ecee709d053586001bf298846d6a5cf3bb048ee6880148fdb149

SHA512
125d278e29dfa52c7d9c595f6c4e7346bd804665061db6c38ff45ce0796fb5092d7cd6a9ebcef2d8926c237456bc1cdeb25816b73d3754dac68f18fad83bdfd4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
c6f727fbadd4f75a1e67189127ac3de6

SHA1
e31785e7a01aaf8cca14a4d3f1eaae77b1cf7a4f

SHA256
d0e1e4d42480fb1d0eaebddbd601f797dac4f333c6dd736b5326e6833e0a7c47

SHA512
b6e33c99c71a2e2bfe1477d8446bad999a0a2efb4a04e3d0a981c06bd7d63d3301c40d541745ee4f83f2428ca28617c34d00d4c541436189d106e65b4545d82f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\15f11071-a84b-4d54-8631-5a0120a4f920

Filesize
671B

MD5
db9b0f705228bed80801a9ef55c523f4

SHA1
2a0c7e42c2099f02bfeebb31e6b281c227b67911

SHA256
6f9da6bf365577f6c981ea1b175e6fd094b00485eb3c417e1c664ab0b89c3cc8

SHA512
491411d9e4374d001f144e3c80e014f7287e443090a46c801c6f458e77ed4608c391f763094fe1991f7de26a8d88d764e660a45dca0d820e4b77e20c8a294948

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\64f65174-e1d1-4639-a1c3-f190902328a6

Filesize
29KB

MD5
0c18ed24fe9cf45d42618b807ed1bfbf

SHA1
ccbf166a97b92a4715e7c84ae8e67000d1e12488

SHA256
9a792c950858f6b9e704a7ae1aedb39a32598b70d3a84d322a4d3678e9caf8a2

SHA512
48597d21b64d73b37eb47c7ed7a52ac3c2b3362dcb8bd5166f45b8fc82759fb06187597231298f65ab14fa0b96a39b1d221caadb9d94335b2305dbb36fcca1a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\b8f920db-ef6a-4d1c-a8ff-4db3030a199d

Filesize
982B

MD5
9071d1d4f6679ce169623b3c84f17d3f

SHA1
add9e85ccc3dcfe2e16991833213ad1019b5ec25

SHA256
65c2d11e2221edb33405e5dd9957c844522e843432aa2df467335ecb24d5b28d

SHA512
9430ea5cd86ad9399696fc9700addb99753b35b56d7f06223e785e58da68fe1a21620fa4ac5d1c4db91a6faeba1ad9439348eec93fa1383ce9228f18dc9744e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

Filesize
12KB

MD5
980f03e5a552d97b8dfefba41bef0148

SHA1
f91faf6f12114ff27de47cf5cdc7e74d82165ba9

SHA256
f193355074883e5c719f9f4608cc544b6128ddc08493f6a80c9a675232c62d1e

SHA512
515d6f971ce81409c0072fb799758d721e3b53f9f1c22b872c48981486faba8a8e47f30e53e88d1ff90caf02c3936528f24b26adc4b2f9940ae73aec90227744

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

Filesize
11KB

MD5
2a040eaffdf365262e171a8b7990254b

SHA1
c99d7ceb45751b624a8e34de8f09dc27e883d160

SHA256
e11b9cf07ca5f660c59ac2aa503e405a2752748182017177539c04d92fc473d6

SHA512
c15043cba30c63ca4331bef91e6a7adfae4e0dfa062e9de20411ea757d135046447ca8abefdd24aaae04627dfdfb35923193e8ea7ca5ba2a5590d2af316b5e23

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

Filesize
11KB

MD5
0cd5d394dab82cc97cf697b3384b8e93

SHA1
23fed70e2700be451f7f7d38c00b5c8a8351dea3

SHA256
cada96429833414a62295eae0e0ca257a05d0593480615c549af4012df52d9f2

SHA512
57c8931f27749f1d67ddcc6861f94770ba118f8fbe39f09f8ff0f5c5584f528560a0b1c2f83517e36e66fb9bd0ecb4d5d8c1d5f3ed0a538aaeac32ef56969b21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

Filesize
11KB

MD5
fff0ef3c62d2faf3459afec8f9ec4399

SHA1
78a5b72c50e6ae47818b006bf3c6f0601f74ef7d

SHA256
bea18403335b0c3462ea4361eed4aef6ea1ff775d97acd956245b92de727689e

SHA512
ee907bd3487783f8070910ae0490a2229346964c2f79028daa99988dbb1958761e5113e8afed36f8274d830a247cad1b1444dc695963d58d687f599fcd0bf25f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs.js

Filesize
11KB

MD5
6a9dbe26e796bbf09b3d338d77c05813

SHA1
1047d496761daea253488f88277b84d8b17c5e81

SHA256
6003b0a5c4e1a9cdcd14691e52a68226edebff89e3b550ace3df77f55745f88e

SHA512
dbe6b15cbcbdb68047523f1957e562b1d54625b09c6e69c42d4444cea7492fd39b993aaee9b07e10a4f2922818dc401f6d129c5d003be5ada277b640779a57c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
996af3786d5524295caa6dff2900eace

SHA1
fffe38b53f68e3e7a80bdb4ed81940bfb45cba20

SHA256
e5be9c21176bff4635731c16f55d930b53891bc88ae40226a80691d6d40f947d

SHA512
4fb2f14a67c699c2f3bbd07ca0a50cedd78c357c9e3ac0a4070e653c9201789c73b277d632df8992c4ca7815195f46035dcc9c1a084f1f4aa9a8594aac121600

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
a300f88123ae8eb20d4a8ecfa3be9477

SHA1
9b14cdedfaf1d19d22a6f557f7cf0de5ac0e6142

SHA256
c6f3a935c05efdbf36947bbf5d8f7ba4b5a7c852f73c274a08d2d1cb545aafda

SHA512
da6971acd6b9e411c5311adf37f3faebd0953d130ffff394d05de05b087c3155051c1f014e953142d40997fbc57685bd1b3f972d354740b9ff2de87720c471dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
8267fd127944d69e830d5dc0a52befde

SHA1
0a6acb139ab4eaa5c0c1e4cfe8c8e16119d2e50c

SHA256
7ecb5806c5f090f4993f87125e564ea0e09a2b6837d3406fb0cdd4541b32d7ca

SHA512
c07159969ec15d8bb44d1e9fb8c7983c1ec475a64922bb6370455bec382e81c244b46cc279a75efb3683fd5f9ee9ecf75872bf59548c4dd7dd6c88a2d890e6af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
c11ad1202194ef14485ccdb37fc1434b

SHA1
e762307930e30aa2fe8f1eee1e6d9968467cdb3b

SHA256
6a2737445af03e548bae1ac885a694dba8a0f376e255700b1ffe208e96b33c76

SHA512
95ec8f8ba4a6d5c4212f32eabfb038c64cfa76eb8756af5fb02cfcda42f0f80b80c2b9f7ec9b66498f3874ecbb868ca81206749dcad954781f0368b74c6c3341

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
4daca6bea3306e2aad3a7d768ab976e7

SHA1
f2be264b314c63070a469a2c4258bbf4bacb3c40

SHA256
7ff67fdf1810c8a65eeb85a019a53a32dde5f34dcd9ecfa92285fed6fd5cc554

SHA512
9a8e35ad6334077de14ce1feeb8b2ebb2589dea8ca70fabd2f621c176aa0d98fe1774ea4253a1699a52f73cc57ba2077256227dc8e737340bbd80c7d6813690a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
ebc388475805c8206ca205fc3488d9f6

SHA1
ee9e17558cbdf5aa2e3b0dbd42ab16417173268a

SHA256
6ce621fa417f1c1e80ccfaf30066502069e0c1dbaf01d6465aba35f09011077c

SHA512
237b1676019b8f6af8946dbbc22914b9006bf1c0ae9da3b010fb61fe27f25557593748d1e560df0ca8be163afd3afaa4d36825dafe30913c94c9c0e0de2b3290

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
f9073a571b24526bb30f88eee4d279b1

SHA1
2eb8429019527d8af5c77a860700c52240cf8519

SHA256
f0e9452d2c7dd8f68d494a3e6ad202ad8d768df4fc280c91913e3d2f6d9dff22

SHA512
1413dffd36ebf3e2edbdf9a399138d310e9a941b533248396409999be09951f1044ee5d01f49948feefe3ff61c1c8beb7066fa24131fa4621540b371e1268a64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
68bd6aeceb757c17da25c4f0c0bf8a9a

SHA1
b7a9c209a7991e7b305af46f19d2ce4010306302

SHA256
ad1e755c1743a650510f698af639f2060d62a4572b71faf545d00e0f0db506c3

SHA512
723c0c5008e47f5be1c1907a54781ef436558cb277c4a8874d2269d9c015a5eb28eb5aced2ba6460f87350c7734a5d2a77354474ad60ec6a62b76ab1454651ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
5bada54124c9b5bd9b70d1d782bd7acb

SHA1
f6893f8e0257b762a9d2e20ff752e357fc3e39ab

SHA256
03d19f230ef4b6b716a0db03a6a8841ccd58796b2be4dfef13a1add1f818d96a

SHA512
728bd65a20085a04b683110a3b1a6e193d05f2f5bc1648d2ff181cb5facc5e612cfde82330c9527b6383df3399880d00d644425da9a69753917b91b09a583dc5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
b07d65b96d02341435b4ba2035681c50

SHA1
bad81653ceb2335af8c5c8cc05f39e718fe9ad1d

SHA256
9d2df8a399f321db6d9e743fbccf4d5d03a6ec178e75f6c220e02ba2557f7788

SHA512
060fc028f81e1c5183a2183feadc7952d75777117c6fb8c2104edb5e3354240374ca3065ba0ff436874614f10801241328ded1751504dbb4a64dbcbce61fcaf7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
bb25bc9be4008eb5cd95a182c24c5bde

SHA1
5c54ea001bb4be0907ec64b0f34d0cf0eab226ba

SHA256
dc6e7adcd706229a76b0eaa900087c35894fec0e91fce91dd63c0990fe85900d

SHA512
e1219f62ee62d983b724ef3793360a7bb853d5b5d4332503113c4f54b7603e795a1768ed31b2497930262ea3cb6615d002f6c593dbab4c8a1e61745f7b112cc6

Download Submit
C:\Users\Admin\Desktop\lol\cfg\config.json

Filesize
1KB

MD5
045b4785a50ccb4bdacd74a81950daf4

SHA1
e3982efc55a8d25be1b458fa7ec10de9a0207606

SHA256
6c0379ecc74b789a760a9f7ed995d33425978b573e33fb84cfaccc60c0145f05

SHA512
82b517fd825041933c03f55929a4e35b46a0f07d6f00914097bf356a95ef323dab901b9b534edb012bf1899aa3cc0cdf13655d80505679c9b5ba94e295a9c48f

Download Submit
C:\Users\Admin\Desktop\lol\cfg\themes\default.json

Filesize
1KB

MD5
e057ff020ebdea1171a098361acd9fc1

SHA1
422dbf0804b36a5ea188e4ef820ccc3927c9c25d

SHA256
530e7f1739f57e7212f1926d36eab11c4331019b85d9c19e5e1042e9b21ccab3

SHA512
82d6d5670186c98b8a0f42c12e751d686b8b725a4c848038f7cdc78a1a8034d49da1746411a079ca8fc89d392f267c5fcda4462f1b262a26de8b7856dcbe6bee

Download Submit
C:\Users\Admin\Downloads\release.0kIPCFaJ.zip.part

Filesize
12.1MB

MD5
dd015db5a3673778047bbfc2adcf9c17

SHA1
8cd77507c03f7a4ac9d8fb5d01d0004f338e33cb

SHA256
faca9623e7841c5634c17b56fa17d50a3c86eb9d2302b418563e3d26601343d3

SHA512
f4f8f5d357162351b687931895f77393d6e59a96b9338d7fd9d834edcec780d46675e40c4363f747a7a63247445ae4a48663e332f605f80dadf4f6cc50bcf29a

Download Submit
memory/5196-690-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-689-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-693-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-692-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-694-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-695-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-684-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-685-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-683-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download
memory/5196-691-0x00000193ACAB0000-0x00000193ACAB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads