exelastealer | 8531f0e00bd3595777a4e76832ed81c932c69371b5be79b9b5a5cbec8f9732e6

Analysis

max time kernel
513s
max time network
560s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
15-08-2024 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vape_.rar
Size

14.6MB
MD5

029504c15b770ca7db29eeb7a9334103
SHA1

3dc68216dd75954edc70ec6037563b7b803c9949
SHA256

8531f0e00bd3595777a4e76832ed81c932c69371b5be79b9b5a5cbec8f9732e6
SHA512

8e08daa74c1c32f488cbd665168c6b58062b24556da9636d3e83c498640069b737639b19ccb367f26292bd7914496983d06bc4476d849af0d2d9aec3bf7a6d20
SSDEEP

393216:4Crd77Ie9m8cxixsLlEdlCjugPom3QzI0:4oRbtwfaQjlp3Qz3

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 8 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2096	netsh.exe
2100	netsh.exe
5716	netsh.exe
2644	netsh.exe
988	netsh.exe
4628	netsh.exe
2788	netsh.exe
6432	netsh.exe

Clipboard Data 1 TTPs 8 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
6768	powershell.exe
6956	cmd.exe
7012	powershell.exe
2664	cmd.exe
2012	powershell.exe
1248	cmd.exe
2284	powershell.exe
2808	cmd.exe

Deletes itself 1 IoCs

pid	Process
4396	vape-v4.exe

Executes dropped EXE 8 IoCs

pid	Process
3064	vape-v4.exe
4396	vape-v4.exe
2804	vape-v4.exe
4560	vape-v4.exe
2108	vape-v4.exe
2836	vape-v4.exe
6536	vape-v4.exe
7116	vape-v4.exe

Loads dropped DLL 64 IoCs

pid	Process
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4396	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
4560	vape-v4.exe
2836	vape-v4.exe
2836	vape-v4.exe
2836	vape-v4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001abb0-440.dat	upx
behavioral1/memory/4396-444-0x00007FF8BEE90000-0x00007FF8BF478000-memory.dmp	upx
behavioral1/files/0x000700000001abaa-451.dat	upx
behavioral1/files/0x000800000001ab79-473.dat	upx
behavioral1/files/0x000b00000001ab33-472.dat	upx
behavioral1/files/0x000800000001ab2c-471.dat	upx
behavioral1/files/0x000800000001ab2a-474.dat	upx
behavioral1/files/0x000800000001ab04-478.dat	upx
behavioral1/memory/4396-483-0x00007FF8CC8D0000-0x00007FF8CC8FD000-memory.dmp	upx
behavioral1/memory/4396-485-0x00007FF8C0DA0000-0x00007FF8C0F13000-memory.dmp	upx
behavioral1/files/0x000700000001abb2-484.dat	upx
behavioral1/files/0x000700000001abab-487.dat	upx
behavioral1/memory/4396-494-0x00007FF8BEDD0000-0x00007FF8BEE88000-memory.dmp	upx
behavioral1/memory/4396-493-0x00007FF8BEA50000-0x00007FF8BEDC5000-memory.dmp	upx
behavioral1/files/0x000700000001abad-501.dat	upx
behavioral1/memory/4396-511-0x00007FF8BE900000-0x00007FF8BE922000-memory.dmp	upx
behavioral1/memory/4396-510-0x00007FF8CBF00000-0x00007FF8CBF23000-memory.dmp	upx
behavioral1/memory/4396-524-0x00007FF8C0D70000-0x00007FF8C0D9E000-memory.dmp	upx
behavioral1/memory/4396-528-0x00007FF8BE8C0000-0x00007FF8BE8D1000-memory.dmp	upx
behavioral1/memory/4396-527-0x00007FF8BEDD0000-0x00007FF8BEE88000-memory.dmp	upx
behavioral1/memory/4396-530-0x00007FF8BE8A0000-0x00007FF8BE8BE000-memory.dmp	upx
behavioral1/memory/4396-531-0x00007FF8BE130000-0x00007FF8BE825000-memory.dmp	upx
behavioral1/memory/4396-529-0x00007FF8C49B0000-0x00007FF8C49C5000-memory.dmp	upx
behavioral1/memory/4396-532-0x00007FF8BE0F0000-0x00007FF8BE128000-memory.dmp	upx
behavioral1/memory/4396-526-0x00007FF8CDE30000-0x00007FF8CDE3A000-memory.dmp	upx
behavioral1/memory/4396-523-0x00007FF8BE830000-0x00007FF8BE87D000-memory.dmp	upx
behavioral1/memory/4396-545-0x00007FF8BE930000-0x00007FF8BEA4C000-memory.dmp	upx
behavioral1/memory/4396-522-0x00007FF8BEA50000-0x00007FF8BEDC5000-memory.dmp	upx
behavioral1/memory/4396-521-0x00007FF8BE8E0000-0x00007FF8BE8F9000-memory.dmp	upx
behavioral1/memory/4396-520-0x00007FF8C0DA0000-0x00007FF8C0F13000-memory.dmp	upx
behavioral1/files/0x000700000001ab90-519.dat	upx
behavioral1/files/0x000700000001ab8e-518.dat	upx
behavioral1/memory/4396-517-0x00007FF8BE880000-0x00007FF8BE897000-memory.dmp	upx
behavioral1/files/0x000700000001ab8f-515.dat	upx
behavioral1/memory/4396-547-0x00007FF8BE900000-0x00007FF8BE922000-memory.dmp	upx
behavioral1/files/0x000b00000001ab8b-513.dat	upx
behavioral1/files/0x000700000001abb5-509.dat	upx
behavioral1/memory/4396-507-0x00007FF8BE930000-0x00007FF8BEA4C000-memory.dmp	upx
behavioral1/files/0x000700000001abb3-506.dat	upx
behavioral1/memory/4396-505-0x00007FF8C0D10000-0x00007FF8C0D24000-memory.dmp	upx
behavioral1/memory/4396-504-0x00007FF8CFB20000-0x00007FF8CFB39000-memory.dmp	upx
behavioral1/files/0x000800000001ab1a-503.dat	upx
behavioral1/memory/4396-502-0x00007FF8C0D30000-0x00007FF8C0D44000-memory.dmp	upx
behavioral1/memory/4396-499-0x00007FF8C0D50000-0x00007FF8C0D62000-memory.dmp	upx
behavioral1/memory/4396-498-0x00007FF8CDE40000-0x00007FF8CDE64000-memory.dmp	upx
behavioral1/files/0x000800000001ab28-497.dat	upx
behavioral1/memory/4396-496-0x00007FF8C49B0000-0x00007FF8C49C5000-memory.dmp	upx
behavioral1/files/0x000800000001aafc-495.dat	upx
behavioral1/memory/4396-491-0x00007FF8C0D70000-0x00007FF8C0D9E000-memory.dmp	upx
behavioral1/memory/4396-548-0x00007FF8BE880000-0x00007FF8BE897000-memory.dmp	upx
behavioral1/memory/4396-490-0x00007FF8BEE90000-0x00007FF8BF478000-memory.dmp	upx
behavioral1/files/0x000700000001aba9-489.dat	upx
behavioral1/memory/4396-482-0x00007FF8CBF00000-0x00007FF8CBF23000-memory.dmp	upx
behavioral1/memory/4396-481-0x00007FF8CDDD0000-0x00007FF8CDDE9000-memory.dmp	upx
behavioral1/files/0x000800000001ab20-479.dat	upx
behavioral1/memory/4396-477-0x00007FF8CF460000-0x00007FF8CF46D000-memory.dmp	upx
behavioral1/files/0x000700000001abb1-476.dat	upx
behavioral1/memory/4396-475-0x00007FF8CFB20000-0x00007FF8CFB39000-memory.dmp	upx
behavioral1/files/0x000800000001ab29-469.dat	upx
behavioral1/files/0x000a00000001ab27-467.dat	upx
behavioral1/files/0x000800000001ab19-464.dat	upx
behavioral1/files/0x000800000001ab09-463.dat	upx
behavioral1/files/0x000700000001abae-457.dat	upx
behavioral1/memory/4396-454-0x00007FF8D0260000-0x00007FF8D026F000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs

Web Service

T1102

flow	ioc
128	discord.com
782	discord.com
786	discord.com
124	discord.com
127	discord.com
175	discord.com
176	discord.com
783	discord.com
123	discord.com
126	discord.com
171	discord.com
172	discord.com
771	discord.com
772	discord.com
773	discord.com
784	discord.com
785	discord.com
125	discord.com
173	discord.com
770	discord.com
774	discord.com
775	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
116	ip-api.com
768	ip-api.com

Network Service Discovery 1 TTPs 8 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5344	cmd.exe
7040	ARP.EXE
4400	cmd.exe
808	ARP.EXE
1056	cmd.exe
1388	ARP.EXE
4196	cmd.exe
5792	ARP.EXE

Enumerates processes with tasklist 1 TTPs 20 IoCs

discovery

Process Discovery

T1057

pid	Process
7144	tasklist.exe
4656	tasklist.exe
3528	tasklist.exe
6276	tasklist.exe
3156	tasklist.exe
6920	tasklist.exe
2604	tasklist.exe
3000	tasklist.exe
4700	tasklist.exe
5620	tasklist.exe
4124	tasklist.exe
2028	tasklist.exe
6252	tasklist.exe
5772	tasklist.exe
1188	tasklist.exe
2968	tasklist.exe
1848	tasklist.exe
4680	tasklist.exe
168	tasklist.exe
5884	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4508	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4576	sc.exe
2804	sc.exe
2980	sc.exe
4744	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000800000001aae9-387.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2416	netsh.exe
5196	cmd.exe
6416	netsh.exe
4568	cmd.exe
2628	netsh.exe
2644	cmd.exe
3560	netsh.exe
6728	cmd.exe

System Network Connections Discovery 1 TTPs 4 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1872	NETSTAT.EXE
2788	NETSTAT.EXE
684	NETSTAT.EXE
1636	NETSTAT.EXE

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Collects information from the system 1 TTPs 4 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3892	WMIC.exe
1832	WMIC.exe
4124	WMIC.exe
4248	WMIC.exe

Detects videocard installed 1 TTPs 4 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4776	WMIC.exe
2248	WMIC.exe
4272	WMIC.exe
4700	WMIC.exe

Gathers network information 2 TTPs 8 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2788	NETSTAT.EXE
5828	ipconfig.exe
684	NETSTAT.EXE
5556	ipconfig.exe
1636	NETSTAT.EXE
1148	ipconfig.exe
1872	NETSTAT.EXE
2780	ipconfig.exe

Gathers system information 1 TTPs 4 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5104	systeminfo.exe
2276	systeminfo.exe
4872	systeminfo.exe
3580	systeminfo.exe

Kills process with taskkill 24 IoCs

evasion

pid	Process
4668	taskkill.exe
4876	taskkill.exe
1332	taskkill.exe
7096	taskkill.exe
6504	taskkill.exe
1556	taskkill.exe
1360	taskkill.exe
4584	taskkill.exe
164	taskkill.exe
2172	taskkill.exe
2944	taskkill.exe
668	taskkill.exe
3140	taskkill.exe
360	taskkill.exe
6464	taskkill.exe
5380	taskkill.exe
4552	taskkill.exe
4764	taskkill.exe
6868	taskkill.exe
6840	taskkill.exe
6092	taskkill.exe
2108	taskkill.exe
4244	taskkill.exe
1604	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Vape_V4.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\api-ms-win-crt-runtime-l1-1-0.zip:Zone.Identifier	firefox.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2012	powershell.exe
2012	powershell.exe
2012	powershell.exe
2284	powershell.exe
2284	powershell.exe
2284	powershell.exe
6768	powershell.exe
6768	powershell.exe
6768	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4496	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeDebugPrivilege	2624	firefox.exe
Token: SeRestorePrivilege	1576	7zG.exe
Token: 35	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeSecurityPrivilege	1576	7zG.exe
Token: SeIncreaseQuotaPrivilege	4776	WMIC.exe
Token: SeSecurityPrivilege	4776	WMIC.exe
Token: SeTakeOwnershipPrivilege	4776	WMIC.exe
Token: SeLoadDriverPrivilege	4776	WMIC.exe
Token: SeSystemProfilePrivilege	4776	WMIC.exe
Token: SeSystemtimePrivilege	4776	WMIC.exe
Token: SeProfSingleProcessPrivilege	4776	WMIC.exe
Token: SeIncBasePriorityPrivilege	4776	WMIC.exe
Token: SeCreatePagefilePrivilege	4776	WMIC.exe
Token: SeBackupPrivilege	4776	WMIC.exe
Token: SeRestorePrivilege	4776	WMIC.exe
Token: SeShutdownPrivilege	4776	WMIC.exe
Token: SeDebugPrivilege	4776	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4776	WMIC.exe
Token: SeRemoteShutdownPrivilege	4776	WMIC.exe
Token: SeUndockPrivilege	4776	WMIC.exe
Token: SeManageVolumePrivilege	4776	WMIC.exe
Token: 33	4776	WMIC.exe
Token: 34	4776	WMIC.exe
Token: 35	4776	WMIC.exe
Token: 36	4776	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4776	WMIC.exe
Token: SeSecurityPrivilege	4776	WMIC.exe
Token: SeTakeOwnershipPrivilege	4776	WMIC.exe
Token: SeLoadDriverPrivilege	4776	WMIC.exe
Token: SeSystemProfilePrivilege	4776	WMIC.exe
Token: SeSystemtimePrivilege	4776	WMIC.exe
Token: SeProfSingleProcessPrivilege	4776	WMIC.exe
Token: SeIncBasePriorityPrivilege	4776	WMIC.exe
Token: SeCreatePagefilePrivilege	4776	WMIC.exe
Token: SeBackupPrivilege	4776	WMIC.exe
Token: SeRestorePrivilege	4776	WMIC.exe
Token: SeShutdownPrivilege	4776	WMIC.exe
Token: SeDebugPrivilege	4776	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4776	WMIC.exe
Token: SeRemoteShutdownPrivilege	4776	WMIC.exe
Token: SeUndockPrivilege	4776	WMIC.exe
Token: SeManageVolumePrivilege	4776	WMIC.exe
Token: 33	4776	WMIC.exe
Token: 34	4776	WMIC.exe
Token: 35	4776	WMIC.exe
Token: 36	4776	WMIC.exe
Token: SeDebugPrivilege	2968	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3564	WMIC.exe
Token: SeSecurityPrivilege	3564	WMIC.exe
Token: SeTakeOwnershipPrivilege	3564	WMIC.exe
Token: SeLoadDriverPrivilege	3564	WMIC.exe
Token: SeSystemProfilePrivilege	3564	WMIC.exe
Token: SeSystemtimePrivilege	3564	WMIC.exe
Token: SeProfSingleProcessPrivilege	3564	WMIC.exe
Token: SeIncBasePriorityPrivilege	3564	WMIC.exe
Token: SeCreatePagefilePrivilege	3564	WMIC.exe
Token: SeBackupPrivilege	3564	WMIC.exe
Token: SeRestorePrivilege	3564	WMIC.exe
Token: SeShutdownPrivilege	3564	WMIC.exe
Token: SeDebugPrivilege	3564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3564	WMIC.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
1576	7zG.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
2836	vape-v4.exe
1592	firefox.exe
1592	firefox.exe
2964	7zG.exe
5896	mshta.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
4496	OpenWith.exe
2340	AcroRd32.exe
2340	AcroRd32.exe
2340	AcroRd32.exe
2340	AcroRd32.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
2624	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe
1592	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2340	4496	OpenWith.exe	73
PID 4496 wrote to memory of 2340	4496	OpenWith.exe	73
PID 4496 wrote to memory of 2340	4496	OpenWith.exe	73
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 204 wrote to memory of 2624	204	firefox.exe	76
PID 2624 wrote to memory of 3556	2624	firefox.exe	77
PID 2624 wrote to memory of 3556	2624	firefox.exe	77
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78
PID 2624 wrote to memory of 3344	2624	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1560	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Vape_.rar
1⤵
- Modifies registry class
PID:4892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Vape_.rar"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:64
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE791BA82ED591557CC916EF0C678089 --mojo-platform-channel-handle=1620 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3584
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=14CAA7E3A18A52CA6E3659E63216D91A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=14CAA7E3A18A52CA6E3659E63216D91A --renderer-client-id=2 --mojo-platform-channel-handle=1612 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4168

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:204
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.0.1321349447\1783713685" -parentBuildID 20221007134813 -prefsHandle 1688 -prefMapHandle 1676 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4a510fb-888f-4a6b-9771-d7165ac396c6} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 1780 223c4905358 gpu
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.1.576140675\919449280" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2084 -prefsLen 20848 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f8c40aa-b4be-44a6-ab6b-9eda3495f9a6} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 2120 223b136fe58 socket
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.2.1134216540\1497379280" -childID 1 -isForBrowser -prefsHandle 2920 -prefMapHandle 2916 -prefsLen 20951 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {895d0fd9-55fa-4580-be24-264a0c9d4f51} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 2932 223c79c4558 tab
    3⤵
    PID:2460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.3.1196894120\370194847" -childID 2 -isForBrowser -prefsHandle 3496 -prefMapHandle 3492 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {011efce4-069a-4c55-9ddb-3f3b7d8ba2eb} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 3468 223b135e858 tab
    3⤵
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.4.1866814653\994337099" -childID 3 -isForBrowser -prefsHandle 4664 -prefMapHandle 3924 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70fc6373-aff6-4079-b2cf-f52f2868a9ab} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 4688 223c9f3e758 tab
    3⤵
    PID:4636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.5.82667361\226087858" -childID 4 -isForBrowser -prefsHandle 2584 -prefMapHandle 4664 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {84b4ba11-6e01-4014-94c6-542718b3cafd} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 4568 223b1369658 tab
    3⤵
    PID:1344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.6.325039317\1755788469" -childID 5 -isForBrowser -prefsHandle 5116 -prefMapHandle 5124 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a930251-e541-4dfc-ab3b-57b9b5e06ea0} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 5104 223ca298258 tab
    3⤵
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.7.94142076\416894289" -childID 6 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa4989aa-fb11-4105-86ad-c618b23682d4} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 5304 223ca617458 tab
    3⤵
    PID:1332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.8.1775340260\1081473731" -childID 7 -isForBrowser -prefsHandle 4460 -prefMapHandle 5604 -prefsLen 26433 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5b4fe32-ea7a-4b96-bad2-95a9d19ebf6f} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 5356 223c6455358 tab
    3⤵
    PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2624.9.1671842754\456541103" -childID 8 -isForBrowser -prefsHandle 5792 -prefMapHandle 5764 -prefsLen 26873 -prefMapSize 233414 -jsInitHandle 1264 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7857486d-4c0c-4be1-a50c-5a899240e4f7} 2624 "\\.\pipe\gecko-crash-server-pipe.2624" 5804 223cbe3fe58 tab
    3⤵
    PID:1604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4076

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Vape_V4\" -spe -an -ai#7zMap14174:76:7zEvent19652
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1576

C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
"C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
1⤵
- Executes dropped EXE
PID:3064
- C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
  "C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:2944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3356
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:2840
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3572
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:312
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:2968
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3400
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2624"
    3⤵
    PID:936
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2624
      4⤵
      Kills process with taskkill
      PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3556"
    3⤵
    PID:3532
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3556
      4⤵
      Kills process with taskkill
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3344"
    3⤵
    PID:2672
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3344
      4⤵
      Kills process with taskkill
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2460"
    3⤵
    PID:4680
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2460
      4⤵
      Kills process with taskkill
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4888"
    3⤵
    PID:196
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4888
      4⤵
      Kills process with taskkill
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1344"
    3⤵
    PID:2600
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1344
      4⤵
      Kills process with taskkill
      PID:668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1332"
    3⤵
    PID:1632
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1332
      4⤵
      Kills process with taskkill
      PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 760"
    3⤵
    PID:3540
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 760
      4⤵
      Kills process with taskkill
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1604"
    3⤵
    PID:1508
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1604
      4⤵
      Kills process with taskkill
      PID:1332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2208
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:4744
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:1216
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:4440
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3312
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4568
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4400
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4872
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:3892
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:1640
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:4672
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:4328
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:4484
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:2100
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:708
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:3816
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:2680
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:3536
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:2340
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:4284
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:208
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:2600
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:1848
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1148
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:1632
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:808
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1872
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:4576
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2644
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4516
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3780
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4440

C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
"C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
1⤵
- Executes dropped EXE
PID:2804
- C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
  "C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:356

C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
"C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
1⤵
- Executes dropped EXE
PID:2108
- C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
  "C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:2836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:880
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:3400
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5088
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:4548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4896
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:2668
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:4320
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:708
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2152
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:4208
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4840
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:1508
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4084
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:2284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2644
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:1056
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3580
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:1492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:1832
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:2852
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:960
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:2808
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:1904
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:3300
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:2208
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:5076
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:3992
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:3980
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:3420
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:4044
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:3904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:3352
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3528
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2780
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2340
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:1388
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:2788
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:2804
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4628
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4348

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3788
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.0.1818298198\1923167617" -parentBuildID 20221007134813 -prefsHandle 1604 -prefMapHandle 1588 -prefsLen 21291 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c623534-aec5-4b72-a4cc-7e6312bac8a1} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 1684 1f8f5df0358 gpu
    3⤵
    PID:2620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.1.1867057567\626376296" -parentBuildID 20221007134813 -prefsHandle 1988 -prefMapHandle 1984 -prefsLen 21336 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4ccd218-82ae-4077-bff0-c0a5f6e5d162} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 2000 1f8eaeded58 socket
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.2.1571927951\753894065" -childID 1 -isForBrowser -prefsHandle 2980 -prefMapHandle 2976 -prefsLen 21797 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac029108-5c0b-467c-bc20-27d524a01457} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 2992 1f8f9842258 tab
    3⤵
    PID:4876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.3.113476006\1002365707" -childID 2 -isForBrowser -prefsHandle 3468 -prefMapHandle 3464 -prefsLen 26145 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {371b2191-43c6-442e-b900-87b26c08bfe5} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 3476 1f8eae69c58 tab
    3⤵
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.4.1332624949\801171002" -childID 3 -isForBrowser -prefsHandle 4060 -prefMapHandle 4052 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0480a9db-74b2-4ca3-8ed4-1cee8a485e2c} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 4072 1f8eae61058 tab
    3⤵
    PID:748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.5.908400214\206462330" -childID 4 -isForBrowser -prefsHandle 4548 -prefMapHandle 4536 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3160461-b173-4bbe-aa94-673ac6abc7b2} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 4600 1f8fa5a1b58 tab
    3⤵
    PID:4244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.6.974298615\1481573065" -childID 5 -isForBrowser -prefsHandle 4624 -prefMapHandle 4612 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48ba518d-1f70-4d74-8dfa-cd9be742d4c4} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 4720 1f8fa5a0058 tab
    3⤵
    PID:60
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.7.1454807770\1600234383" -childID 6 -isForBrowser -prefsHandle 4972 -prefMapHandle 4976 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32d76c93-6741-4142-8e8a-e75c9e831c2e} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 4964 1f8fa5a1e58 tab
    3⤵
    PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.8.2124261924\587963551" -childID 7 -isForBrowser -prefsHandle 2308 -prefMapHandle 4388 -prefsLen 26934 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a65dcae4-4f9f-45b6-9f77-a4b644bfdc4c} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 2200 1f8eae61058 tab
    3⤵
    PID:3744
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.9.1489299674\1001098411" -childID 8 -isForBrowser -prefsHandle 4452 -prefMapHandle 5464 -prefsLen 26934 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {883d9faf-d696-4047-8ff8-290841b2f2f4} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 5480 1f8fad6a058 tab
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.10.2147436264\1266417172" -childID 9 -isForBrowser -prefsHandle 4848 -prefMapHandle 4832 -prefsLen 26934 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32cdc1f2-61c5-4686-ac28-47eee8bc80bd} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 4932 1f8eb5d4c58 tab
    3⤵
    PID:804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.11.2103935714\1791713299" -childID 10 -isForBrowser -prefsHandle 5020 -prefMapHandle 4964 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d10697b5-26e9-48f5-bf11-ca5522349974} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 4608 1f8eae65358 tab
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.12.492098782\976949052" -childID 11 -isForBrowser -prefsHandle 10088 -prefMapHandle 10092 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38c6652a-f6dd-4e32-b88c-93d11801c791} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 10076 1f900d74358 tab
    3⤵
    PID:1596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.13.452068841\2132695552" -childID 12 -isForBrowser -prefsHandle 9924 -prefMapHandle 9920 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bdf8645-58bd-4232-9428-db8bd9aee04b} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9948 1f900d8ab58 tab
    3⤵
    PID:1080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.14.877879074\519502748" -childID 13 -isForBrowser -prefsHandle 9692 -prefMapHandle 9684 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c71f6985-0150-44ef-87a0-6269add312dc} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9836 1f900671458 tab
    3⤵
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.15.1504788256\1537999923" -childID 14 -isForBrowser -prefsHandle 9504 -prefMapHandle 9512 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {affc8c68-3ec6-48e3-a174-330d4b0e809a} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9532 1f900672358 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.16.1562852018\1205626834" -childID 15 -isForBrowser -prefsHandle 9196 -prefMapHandle 9192 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8800ddd-8a27-4e81-a4f3-52a73c224717} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9368 1f901356758 tab
    3⤵
    PID:208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.17.59710650\1002001364" -childID 16 -isForBrowser -prefsHandle 9064 -prefMapHandle 9056 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6893e57c-a0d5-4336-9308-8e65f34cf95f} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9076 1f901580b58 tab
    3⤵
    PID:2180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.18.1295403573\699572208" -childID 17 -isForBrowser -prefsHandle 8808 -prefMapHandle 8812 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14a53566-ef7f-4754-8b9b-d9d1cea3877d} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 5172 1f90191fa58 tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.19.1107084148\1710608517" -childID 18 -isForBrowser -prefsHandle 8764 -prefMapHandle 8760 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b22a3105-d3e8-48be-853f-772ec3b76d88} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8772 1f901920958 tab
    3⤵
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.20.864480360\903846780" -childID 19 -isForBrowser -prefsHandle 8568 -prefMapHandle 8564 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb3b41e7-320f-437c-934e-420881cd4d56} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8576 1f901921258 tab
    3⤵
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.21.566434108\767695945" -parentBuildID 20221007134813 -prefsHandle 8296 -prefMapHandle 8360 -prefsLen 27634 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d9e8989-2a16-49fe-9b5b-20320a540ecd} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8308 1f901a96f58 rdd
    3⤵
    PID:5568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.22.1967423916\1383802378" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 8364 -prefMapHandle 8568 -prefsLen 27634 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6aa9096b-2f8e-496c-ad4c-9399760585bd} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8316 1f901a96358 utility
    3⤵
    PID:5576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.23.530948917\564301186" -childID 20 -isForBrowser -prefsHandle 5640 -prefMapHandle 8080 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9295c43a-ebab-4098-89da-cf574507db33} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8052 1f8fe14de58 tab
    3⤵
    PID:5520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.24.1285092432\1960008655" -childID 21 -isForBrowser -prefsHandle 7840 -prefMapHandle 7844 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96a7eb9e-bac4-42d9-95ab-ca465cbfd1e3} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 7832 1f8fe6ea558 tab
    3⤵
    PID:5284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.25.891702514\102794671" -childID 22 -isForBrowser -prefsHandle 8080 -prefMapHandle 5640 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1be85984-4dcb-45d5-be5a-9d8e8f28c6a7} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 7924 1f8fe6eb158 tab
    3⤵
    PID:5124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.26.1226234456\1028442512" -childID 23 -isForBrowser -prefsHandle 7732 -prefMapHandle 7696 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c79ecf7-5242-4f38-9a62-7b669555dbcc} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9372 1f902a70e58 tab
    3⤵
    PID:6200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.27.1868073193\1892895435" -childID 24 -isForBrowser -prefsHandle 7324 -prefMapHandle 7380 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {583ba85b-9355-4f95-8105-2456876f98f5} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9308 1f902db4358 tab
    3⤵
    PID:6632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.28.1928267043\1841300683" -childID 25 -isForBrowser -prefsHandle 7228 -prefMapHandle 4596 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ae869f1-aaa2-4f2b-8f82-d0df620399b5} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 7220 1f903b5cd58 tab
    3⤵
    PID:7024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.29.1427238619\593884046" -childID 26 -isForBrowser -prefsHandle 6984 -prefMapHandle 6980 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {345db657-61a9-4dce-84cb-fe659c29b87f} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 6992 1f903b5d358 tab
    3⤵
    PID:7036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.30.817300785\1590103799" -childID 27 -isForBrowser -prefsHandle 9912 -prefMapHandle 9608 -prefsLen 27634 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87147a90-47ae-469b-b056-01800562b388} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9364 1f8fe653058 tab
    3⤵
    PID:6416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.31.1815085135\1588513522" -childID 28 -isForBrowser -prefsHandle 4248 -prefMapHandle 9340 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {610c69ac-12b8-404f-8997-48d680c4456c} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 5812 1f8fe937358 tab
    3⤵
    PID:4740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.32.598816248\1794049867" -childID 29 -isForBrowser -prefsHandle 4720 -prefMapHandle 4664 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96737bfe-7ff7-45c2-a861-1f9b201b58c1} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 4084 1f902f06d58 tab
    3⤵
    PID:5136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.33.767059303\1319926398" -childID 30 -isForBrowser -prefsHandle 9360 -prefMapHandle 9032 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21bbd844-3729-4c0f-9744-c976586786dd} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9096 1f902f07358 tab
    3⤵
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.34.8398066\2120984522" -childID 31 -isForBrowser -prefsHandle 6988 -prefMapHandle 7856 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3908ed3-7a7e-4ab3-8394-bfb97ab0d477} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 7200 1f903129158 tab
    3⤵
    PID:5812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.35.340878679\295295771" -childID 32 -isForBrowser -prefsHandle 9732 -prefMapHandle 9748 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0be5ca64-2e70-48ea-881d-7bd1c0abbcc6} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 7200 1f9019e5458 tab
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.36.606382459\1312709931" -childID 33 -isForBrowser -prefsHandle 6936 -prefMapHandle 9188 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {36288a41-0ea4-4efe-b515-393427dd2fda} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8840 1f9019e6c58 tab
    3⤵
    PID:5356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.37.1127268547\287403649" -childID 34 -isForBrowser -prefsHandle 7132 -prefMapHandle 9964 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16bfd7d1-37ce-422a-a18f-7d25eb21bfc0} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 7820 1f9033b1058 tab
    3⤵
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.38.1267812189\458784505" -childID 35 -isForBrowser -prefsHandle 7820 -prefMapHandle 7808 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad212954-60d8-4e8e-a74f-5257e908239d} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 6992 1f8fadc7d58 tab
    3⤵
    PID:1948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.39.2119854972\550178495" -childID 36 -isForBrowser -prefsHandle 10068 -prefMapHandle 9672 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc2b73a9-8af1-4c8c-a1ef-65acb359952e} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 10060 1f901df7b58 tab
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.40.1312124876\1545242489" -childID 37 -isForBrowser -prefsHandle 9052 -prefMapHandle 9016 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e35251ce-546c-46fd-9c1c-887f0c05af0e} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8548 1f901df8158 tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.41.878593240\1000068177" -childID 38 -isForBrowser -prefsHandle 4944 -prefMapHandle 4328 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd3156c3-8cbd-4288-8845-f61666de726e} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 5932 1f901df9658 tab
    3⤵
    PID:1416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.42.417171159\1645705531" -childID 39 -isForBrowser -prefsHandle 8824 -prefMapHandle 5664 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {290ee810-c727-44b8-9582-76a7d432c4de} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 6944 1f903bb9e58 tab
    3⤵
    PID:7052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.43.549152678\1201461966" -childID 40 -isForBrowser -prefsHandle 8032 -prefMapHandle 8792 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8cbdfe9-8356-4dfc-b94e-8c93516ab50c} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 8028 1f902406858 tab
    3⤵
    PID:4200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.44.125191843\2034798914" -childID 41 -isForBrowser -prefsHandle 8004 -prefMapHandle 7952 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20db74c1-119c-41c6-922b-4998019f4bfd} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 7092 1f902c3c958 tab
    3⤵
    PID:3148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1592.45.83344456\609261092" -childID 42 -isForBrowser -prefsHandle 7364 -prefMapHandle 7304 -prefsLen 27748 -prefMapSize 233583 -jsInitHandle 1020 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb37aff9-f319-461e-9d28-7cdd5ef025a2} 1592 "\\.\pipe\gecko-crash-server-pipe.1592" 9344 1f9013d5f58 tab
    3⤵
    PID:5628

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\api-ms-win-crt-runtime-l1-1-0\" -spe -an -ai#7zMap23168:120:7zEvent15526
1⤵
- Suspicious use of FindShellTrayWindow
PID:2964

C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
"C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
1⤵
- Executes dropped EXE
PID:6536
- C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
  "C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
  2⤵
  - Executes dropped EXE
  PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1744
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:4396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5968
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:4044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:6828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5236
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:7016
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6760
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1592"
    3⤵
    PID:4448
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1592
      4⤵
      Kills process with taskkill
      PID:6868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2620"
    3⤵
    PID:6044
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2620
      4⤵
      Kills process with taskkill
      PID:6840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3176"
    3⤵
    PID:2340
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3176
      4⤵
      Kills process with taskkill
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4876"
    3⤵
    PID:5656
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4876
      4⤵
      Kills process with taskkill
      PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4320"
    3⤵
    PID:6336
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4320
      4⤵
      Kills process with taskkill
      PID:360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3744"
    3⤵
    PID:3540
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3744
      4⤵
      Kills process with taskkill
      PID:6464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5568"
    3⤵
    PID:6924
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5568
      4⤵
      Kills process with taskkill
      PID:7096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5576"
    3⤵
    PID:6384
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5576
      4⤵
      Kills process with taskkill
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1948"
    3⤵
    PID:6944
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1948
      4⤵
      Kills process with taskkill
      PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2968"
    3⤵
    PID:5392
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2968
      4⤵
      Kills process with taskkill
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1416"
    3⤵
    PID:6996
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1416
      4⤵
      Kills process with taskkill
      PID:6504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7052"
    3⤵
    PID:6540
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6692
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 7052
      4⤵
      Kills process with taskkill
      PID:164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4200"
    3⤵
    PID:1480
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4200
      4⤵
      Kills process with taskkill
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3148"
    3⤵
    PID:6872
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3148
      4⤵
      Kills process with taskkill
      PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5628"
    3⤵
    PID:3180
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5628
      4⤵
      Kills process with taskkill
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4652
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5404
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:6196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:3924
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:4644
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:168
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:6252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:6768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6728
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4196
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5104
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4772
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4124
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:4548
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:4632
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:2020
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:1272
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:4976
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:1408
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:2820
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:6428
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:6796
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:760
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:3740
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:5840
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:6180
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5772
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:5828
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:5596
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:5792
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:684
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:2980
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6432
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2704
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6880
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6888

C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
"C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
1⤵
PID:5256
- C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe
  "C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe"
  2⤵
  PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:1572
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:5068
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1168
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:2684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4384
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:6520
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:6464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:1928
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:7004
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:1216
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:7008
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:7124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3560
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:7144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      PID:7012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5196
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:5344
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2276
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:5136
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4248
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:5336
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3948
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:1388
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:5332
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:6496
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:2888
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:1608
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:6864
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:4044
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:5176
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:5552
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:5968
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:6268
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5620
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:5556
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:5928
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:7040
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1636
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:4744
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      PID:2100
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2720
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
41KB

MD5
8eeef2615037795c3ba0b7f8df17f190

SHA1
78750059c0c9ba3f4ca46c5bb2eda9cce022b3be

SHA256
33b1533ef5eb8b0267a50b35fbc5f2d0164fc7093dfd69bc22a3661bd924d0d9

SHA512
532b005a179f958bc9497de3db1a737c9a38ad6c0d0d24cda17d8532dbee62431ebe34677621ab053972e5dec01590cbb0a973972ad3a349daf25dc311d4f6f3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\10286

Filesize
8KB

MD5
11ff2824020367c980db132bfb8ca70c

SHA1
0490f08586fbb6c1dfcb3a84e121ecbd5ee108c0

SHA256
2cd0772b95afc977b1b402279f9ffdb27c869f9493a035ff4777ce08165a7c17

SHA512
5c2ed8cceee55e83c27e5304c0c2e5c81fa0e905c306001e9fc1c9b5d8261f860c53c4bfb5e05917ac87f2479d85ba262cf6ca32ee852065ba0a868942daf8a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\10293

Filesize
21KB

MD5
8766392a0acdfef1ff9546eb6a258ef6

SHA1
266a4b5df353eeee10103e57cded44169e86c814

SHA256
37d2fdef01b82767891055379260d5fa88c4b938670af45e9be06f94ca45444d

SHA512
c806bf721c000af7c0ffc5679a51a1cb5370fbda3b8ab19715cd0e14cd5fa57255fa06e68a4309366495b53b03db714c1998be71b266e975f4e997f047108154

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\14513

Filesize
8KB

MD5
55b122d98fb5ed679511e64884f6c90d

SHA1
ba6799239e44183ce28d15adbaae0aefd5e20755

SHA256
6d25377d68f9a1887f6d93a2a63a1184db78f6c02c2374a0d45990b937979758

SHA512
1746b901967385439a0e434a47bd1b200c825454afcfccdc21de1dc8b88d6f6d9a08fc4b94909f0f5f5d7c9247bf47c0b66e5cc7ada90acd82bcc697890f8e81

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\17554

Filesize
7KB

MD5
b4e7885a66dff15078272d981dcb3bb9

SHA1
2a0545902376ce79b40cf12ee62aafab9e6ec493

SHA256
f1aa3616e2ab028c3ffe3943739500c820ca6cb573e9a1b03d329a84fe8ec3b8

SHA512
6869efb68441ad80477d28b794291617eaa847dc8ada1098a782ee001fe43df1b8bfe6342c56ca5576628e2d2dbba7bfdb7c00e39351613d467ca195b7a8bac0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\21723

Filesize
21KB

MD5
c9ecd286115da07d0cdb0b8a30416ea2

SHA1
e73b97c17c20506f8faf5c80f4d20473ff832547

SHA256
70f73f5de1b0f1ae0961b65364336112660567bcef7ec5e18efa4de6641dd556

SHA512
602d83f2007dcd70b5b39350056295fc51d4536e175e7332b83049a8b6fe9f29f86b9524de66610f0e9220057d64fca0d42aa84b00475c323e1f9af3520ecb8a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\2275

Filesize
8KB

MD5
8f51e489a2adcb0b7d8d6cbb6c7e5bc4

SHA1
ce8ae675f2aeff05cd57299e12cd5b7a10546ce3

SHA256
002f356a4e28e7d0b541410eadd348ad1fa0dcf475e5f23baab5e3cd0b86d9b2

SHA512
6c25a40fda2923414bd2487404f2923f2213e9669f9aee6057574386461ec30ea313b03071ca0265d2d926a8c50900efca2ca92569178bb88ff80ad43c345ebe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\25583

Filesize
7KB

MD5
06a10dc9ec2c9d22308dc55841ab2604

SHA1
32e348da50724ed0b4fa6b4327af706000c8535d

SHA256
6adf3c4da9fa2ae5105b1db6b5acedcd50c0ce6bfabd171f36eb4c04c32e58f7

SHA512
617af3141f615da346ada2a4f9cbcb499b15b9f9c26fe6e3843462e7d19943665cf2957f7ff4fae0624dceb496740de4374cb68ce641b03fea78e68e22c1b4ec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\26053

Filesize
8KB

MD5
903e6543ae51e14ade5e1b02720ae501

SHA1
5ebde43faf379d1c2ad53032d377c7ca66ae0f2f

SHA256
e60cd40055ed24b43c5e0451db5921ade4e59722b64311a784e958b9cecd6e66

SHA512
375b147649395a2d9d0a70e6d20efe88905cbc7e7ce4983ca161af2ff58137a3732b2cd4976e81174a164e3242708707091528d828b7d70e93f94203c78520bc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\26504

Filesize
21KB

MD5
0275c973248f94e1a171135efe5d0c12

SHA1
167b5e00db6e68d63f29e6c8dcce8820f1f9e045

SHA256
a1758ea2c5d4278e09fc47b5dac37ca1d9d627d3dd53646df76d6176640c504c

SHA512
be9a3f54bf853b13dd090593b337d9a37dcd019e2192d7fa1f4ccbaf0a15108daefffc478a6a78c56548c9b21dbbc42c699a922c5ab7399aa1d7da715ae5fb28

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\27378

Filesize
8KB

MD5
aab14c061c2a9ded48ff6278b2f8c5c6

SHA1
9eced09b1b62e4fb7a27ed40406d86c2680cecce

SHA256
9fe6bcb899e79b1808c64fca0abdc800658d4ee4a271756bc3ece3f36f4c90a5

SHA512
c1905958a47e072acd1058257789a8b8c33587e72358b4098875b44c99a98af24335564c288a33ab22e41a6f0b94467e0ecd854bb7f0c73bf669aad3beb281d1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\31878

Filesize
8KB

MD5
01aa62c35fb7c9fe66ce1e27a94e4b30

SHA1
18e5bf32ba0fe723cf46b147faf7fec69085de6e

SHA256
a101b68b981758ea6c97bf1b6d13c65e6151e2c262be4b018c75f0911254cc71

SHA512
34338be2f629141c54291b45b28a9b89ea3ca7f0d3e875845a95c23cb733527cd286950305259bc80f16cb94ede944a921fa72962968d72c8e4c5799ac35fa85

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\3783

Filesize
10KB

MD5
425771e7bf395a289d6cf1e3ccf17c24

SHA1
a016c4f4c8c886382e1002396b7c3bf0de0f70b5

SHA256
47912af4e8e150a40c4f90eb3cee83e11df040cfd15519bef6dde79a7994afe8

SHA512
790ee94e7537d22fa1c8d15c6bff468c734b3e77c717cf70744a62084d8778a90d8c490b7bc048ffe8898170f3444729b12b1070e7ad32f4d60d5b7b66b617ee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\0604C17075D80CF8FA06CDAF5E3E8C90602FD0E2

Filesize
13KB

MD5
34ef48479af9b83115433d2e214f7c45

SHA1
b11300a92115a6e314da0f709e1e51d434e109c3

SHA256
f3446316d14f997ad08295a561189c07bfcf940b72a423c27180afdbbb5dedaf

SHA512
0603a3ff63525535cd4dac06331eead2726cb44e8e763eee8ad78fb78d77b71668e2cb06dd62dca1c81a36b4235a9ebe3f3e15a970d2075e8c77c797a355a89f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\08A256C122CC4B6163C84EE1CF3D0E2C8CD28A44

Filesize
737KB

MD5
c97a477cae84cc8ba55f192cb081a88e

SHA1
9fa94be2296c188ecf7556797a9e9ba635858f01

SHA256
956858fab676434ace8d10aef9ea230aedf89c61aa344319df07d691fb5e6245

SHA512
e21649cb62017d4a5a0c67d0e15705626e56a15fe2524e583b2e9e03c8deb91109e37b34cc928e214d5a5815597ac14e183cab4c0ec3351d7df0f13f13838373

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\16E7A505381EF18D5FC80A1BC3831706C75C6EC1

Filesize
247KB

MD5
93e2f23b874ae804555a8809b79acc5f

SHA1
d9f6d7448983ee24d42639a0c6098bdc61d5cab6

SHA256
61e8e87e56806a6abcc84b857a212f32c3186ab23a1609292304d033391e75fe

SHA512
60c7f8ef893a126ad06cf63ebb407d159cd5eedfff8d0f85f10276bd201ac4c778247e49408eb1631e86406988a647ad32e6c4687ded1895af7154d68d6ba677

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\1B9C5F6720A96D157ECCE750AA3084FE56A8959F

Filesize
397KB

MD5
a77f1f5c00ad78f5f573c80cf59b9ad1

SHA1
3e37b311a7eb71573c5af8ba7ce01f4634ac016d

SHA256
a6983f4869cef05aead8665f07b5e435b6b940d1b3ac72ac980c8ec6384607ff

SHA512
a1a90a851e16c48bf89a1753646f2123d6b59e50229daa39c1ad2801ee51c8ddfd39c139d8cf682d9b790e067c3fac212edde787c1a6f86b37a1f7504c9f0601

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\21D1E596AE14F24A279BD999A27DAC4DCCBB08E4

Filesize
85KB

MD5
768de06ed4abe5ac536987c1b7dcab10

SHA1
dbcaa6738df17a3f334262a4c8ed68d8383b12c0

SHA256
8718c6c7daa1da78d9411af9f97645f06ee925f75ddf5e6b2efb5c284408f335

SHA512
0cfa512f2594ab5eec93d8666ef9efcc237ab1e4d11e16cf7988ded9208c583a4a3f73d81926ef7f2892b13b8a0e3e160318a39477abf0c2ccce5c78a1f68fad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\26F1208FE3FFDEA622B5334FB5C27E69B0852C61

Filesize
102KB

MD5
b9d0ff6ce29b31f740a2160855385d06

SHA1
0dc1ad014b22f4adb541bf7de641dba3dfa9558e

SHA256
f0313466b71fb3ab0141ca584a6bfc14b3587f506a7ea9dfff4e8425c43b5e77

SHA512
33e07d711dd7be136a9f6fe314d73f273c490130df955493f3d5ec33daee54788984948debc1a6d6de4ac5e28b8a18647acd43a2e5e2ac2e436552deef6a503f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\2726A961EFCB09E16119F234573F58BF7A3ACCDF

Filesize
120KB

MD5
69f3b9192fa2ced76627363a58464c2a

SHA1
094965f79904e77f9d1e5bea569cc5fb13df8dac

SHA256
3f40608c858eeb97e357030c320ceca19376585a1b76a658a215357d34640965

SHA512
35e28b30d614bdf3f511eabeb46ed924cb98702db5c26733c918644b5e4acc60b716f1f6ebefa2420295ab67e4bc906427008daf429c50a463474ac99046d226

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\2750BF1AE9B9DF18C116090393B65229231A56B4

Filesize
2.6MB

MD5
36ed09ef7130634e5593e5a81ee86b24

SHA1
ddb68861aae614cb8802e6395383a188359bd9f5

SHA256
b653af1d33633aac90c6a007f8ca97da7ce6f2fcc4a22689524f9a263f5194e2

SHA512
35561649844dc7ff789c08258b1009d98b14f14cc60e96082c262485dd681349b37d39d1445c1b101e9a01af4d85a681098f4d73d07940c4ce327db514a3c8a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\29909F8C18920512A7F21898C583E55648B16FDA

Filesize
1.3MB

MD5
353051fe2021dcc8a5eb8e23f86ee50b

SHA1
354e0e5ffe6eed688bc893213690e1ba3f22adea

SHA256
1bcc20ad8ce070f0c95ed72f628583ea8e1660d81d30619589cdd0a63034481e

SHA512
a7a48ab81d4f7c598c811b7f9ecfd9a19f2571aaf12ea0593b3e5099332917086ffe6ca728fe5f1d6225e5b3feff26f497a514ac9253484f6935280b6b62af0d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\29B5B076F049012B37667EA3E4223761F2EE6FB2

Filesize
261KB

MD5
4db2f60b486bddc32eb88d1334aa2b58

SHA1
067727c1b42821c2dc186c8e9dae7a7a25cfbaa2

SHA256
58d79f5fd7ce4691869b9dfae1d8282b09619a03f245b3b823830d9c42788aff

SHA512
9b00a5ef3e0d696efd33f979f6191bb78c17e0182324451afc600cadbbe4477a03119c1a09a4338aa75e919aedbff073a9c8635d7dca6821205ae3793ad2910c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\34B5FA2ED3E45B705D44BF786969DCE9760EC32E

Filesize
14KB

MD5
c187b320c698fdac681d58de6ee08794

SHA1
98b688add413ab5aec6bec7490dc5c6ad717aeb5

SHA256
07cf639c7ebb4b41cae1d7a49ca3dfa80746c2caa94d0f04a9bad1806e7abc02

SHA512
7e151c795b49221a83f2135e2bf9c28fa29841a9f529d000083d40c6f4ea0c7e361a9a380bfbdc60e48ad8b510d6f5e9f3594cb8e26a146731fd5a324c96b0ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\3F99735EE8C279F8BBBB91D53FA6E3307DAD5DE5

Filesize
1.0MB

MD5
38d87029b5fb76d330390ac50a825fd3

SHA1
d7a7dfa4259003f332b9cd01173f4638f4a9ca38

SHA256
3cd4951b830d4c54c4f198bb576d86e8bf947eb07fb00eac2f3c60fc16dec3f1

SHA512
474f0c0261ca936e40e23035c5ac8ead69254b9797a8f9745737e85297337b88bb014149e43e22fad0b50d5290d861b7fc05114477e040687e5893c6fdee0dc0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\428AAAAFC053B2C819A1C1D256F0047471E00FC1

Filesize
19KB

MD5
97ebd3edfadc107af597ebe0ad8b00d0

SHA1
8a1eebe991d00eb03fe8b47efa5e4043530fe9d5

SHA256
db5cb9e1ef2daaf4ca57dc44b8451385ff9a0b0473dd7c17fb49ccf92a937bde

SHA512
c7cb6a6fb9e6336a6b4777d8fd8202304dc4a7ab9fbe3aa1174f730763eb169c4d953a4ee6d24a90d0e703b0b61980073ecc2c37872d167d53bcc389044f97a8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\53D811DE7334DC69E2BF607C294BCB34F1BE4D29

Filesize
14KB

MD5
c7496ac01c01f1c016380547d234f5ff

SHA1
9b395695cf552ffefc69b39129027f6f925c8ede

SHA256
7c3f6597ef17c6b8146d45e3740f90bdaf7216a7b5150f1c93a5bba5aba3c1e5

SHA512
e19b85becd083830e8f5d82f61adff44c1f799715f10cac8af801ecb4de302ea79dd2222b6c4cb4943c0c49a1a321aad5da08b72e1d6be13e3bcf05e73dac202

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\587CD4025CB1F7E562440191D4B731FB3FC44B63

Filesize
166KB

MD5
8ef30eb534edb6770a9e527611ecd088

SHA1
a545fc3feac300b0567323e9958b0c50b050a202

SHA256
387ac83a4535e5ae91503cd90fa95712c149ae4d71e852e20cdce08573b01ea9

SHA512
ed3ce93f721f6991a180907cbf0c598422bd334ed5053c56b9fc8029a63d592c2d0166b7c1e8cb9915d2feeb1cc5db60a2c9c59dcb05e4e42c054b695e7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\5BC1F9D56A03C51185F2AE2DC055433F3D374784

Filesize
524KB

MD5
f51826ec713d2e4dd14a603452fe9207

SHA1
fb657a8bf3d95b14b0bae28e028dca1a07035d83

SHA256
64e04a98f10827e8805eac8120d11cdb6aed2a2b493685a867289722de504b62

SHA512
2eb158df37a24479749e99450bff7ba50d4ae4616e9ac0cf129768ec723c8ab1bede62b26d18c16ed19ae45bcd2e58b2bc3cc7c32444bd80a447703a053684c0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\5E91DB820402FB8254ED644375A42BB58FD1B368

Filesize
274KB

MD5
0203d2d6d62ef0176837a0d2b4aa5be6

SHA1
14203a8140d9eadec2c83c5e8dc243d4b106e826

SHA256
5f37c6bfe470a963752e6d5636217f41ee9d115e3556bfbcf3f02467538312ed

SHA512
c6f10a0e91da7392f6b1e626446e6be95023560ec5520bcb43ab320029498a2aa5d9362c624421cd04779ace295981c764b0ef2600d25f5d46124ef6ed2cf732

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\71DC288D7D8519CE10D2D332B7E19500A5772DAD

Filesize
2.1MB

MD5
7b840aaede6e8c08929e54dcdb6cb830

SHA1
0d980101b66ba05173149d7604fbc4b6e388b21b

SHA256
a715f72078f2f584118be7b44661109318b071adeea23f43309f58e7510aa06c

SHA512
92ca66ae42696808b648ce5f3ba489b606f05f98adb1675ebadf97f61da78071ccfe7e1355a4424a3689908e24bf4417ba37290cbcc6d37c3225f76fdc47956a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\75777E4D4D71352EEDC834A9022A3A5E52563B25

Filesize
17KB

MD5
e35620f57d95d2e675aa96dce1c6baff

SHA1
f17ab32239310d5ec823f5f8df2d3f72e885678e

SHA256
40661168a2b39a84391bc716f6eaf3e5a0a24c9341a2cecd8c893a4d4e4b7370

SHA512
df1a7f93c7d30b2a16cb104c8ba35e6520c92fb1acaddbef323b7f3a0a987f21ceda6820791ed731559bb08c3ca2dc6dc9d19c33e115e0db235cbe7ca9718476

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\7782B767F86E29D540A42BBAB4C57544E4953F65

Filesize
138KB

MD5
8ed1900ace6fd6df154fde9d1fb9f965

SHA1
95d592825330355fab6b068e27f44f5a9f2f1667

SHA256
ddb37af738351a230d21ddf6df1f56407cca98bdf63407f0aad8011f13329e74

SHA512
3251c5feca912f4d189b835edd8fcbd903f15eee6ea96148133125b348baa8429c9a65c7153cafbda08478bf934ae76244e0b40deacb1231f6d4f09b69f2484b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\7E652EB660F04394FA9E19E11FF021EAADB4A60A

Filesize
44KB

MD5
fb2dbd5726c512e5d5c43863fe59535f

SHA1
dbc598a295da1b646c6a30a2ea82e683fd72a6d6

SHA256
ce8da14eef4cb4a8660842afd5ba6bfea2b780458387bde7727a0fa2b7e073f5

SHA512
4900874174ffd97e25207eb0895d0f3e069824b95aa518c85a44cce1578be147de1edd956a962fcfa47db98dfbccea6d5bd9456725bcc432645c67cd0ab7f7e1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\86D341F9988F5E7D7736EEA429480AA07A813642

Filesize
452KB

MD5
f4a9c59983f6e254e8fadfc46c481db2

SHA1
ac9067a5043b554991978d421326d26b502e4109

SHA256
7070f95aee7a606b82004ed62fb03920b89d73dc03f9f959659ec8d90821f2f1

SHA512
097bf89edd126e778c7f78345c779683f7751221d45da85a174773b8cd39c01f20777dfb9422af6dad2179420bc0c1e4826614a4b064f94cef36490f5eb16307

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\87A369EF36EC29B7CDE48D70779CA1799FC88538

Filesize
25KB

MD5
01835f1b648fb0eb736a6114ea648bd9

SHA1
9be9a0598242b349af63aaeafdf1c9256c299143

SHA256
70b9f70c4af015c34715ae864a23d0e094f9a2f0c6613925747f2b68c8459716

SHA512
e3abee9a98c242fdbea8ff61e5be22659adbe33ef6359c07ebf860adcade692907d80e8110694720c7bc3019fce892c77c01723ec55ac869e35e2f66d2d0d6e0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\8C9F59602F0516E86CD2C969DCF52698F9CEE106

Filesize
15KB

MD5
e1c9b4a001a50c7a359c440b8c0bda2d

SHA1
5ac992c976e70f753ed84716d98d4776d62ba37e

SHA256
8ee966d8a762a34e0fd05185ee5e9f50da2ebdeb993ef527f1907456cf514a0a

SHA512
2e6ba51b31456956e8381bcb59a7929c919be2b860e5b37cfb4365e3131520847285b874ab54bfdf1e9ebda2747bfe6d7689d9e038297ba956a7e1c45f2ac227

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\8F9869B3224943C8C2709E31D494BE9CBCE15C5A

Filesize
563KB

MD5
d3d034b6d885a3bee933ce80d90906a7

SHA1
f3cbbb6b8e48aff0b0583d767675b8f8d9d8c7f7

SHA256
65aa83ec6ec7c07d6dae8d3c6577298a8cc6188e7161743a6c6336bb8402f629

SHA512
57d90a288ec74e7734f25e7ce87fc83514043221bc8b0ed8daa58bff26ba46df6d9c75607af869463b76eca872fc0f6a353f3ce14e7dcadf222a24e3eff6d7ca

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\9051C3EDE19BEDDE916B33846DF1CD575D98C47F

Filesize
1.9MB

MD5
5541f00763e75657b07af6e7c23b213a

SHA1
a810818b26abc72b5c37be1c2ee88dde060a1137

SHA256
2feac9baae21eef4fae482315562f6d4d13efae28123afc59bda21fbd65399c7

SHA512
c7653d4f44682c4123657dd0587feb2e049e9128f2007f9a7cce7c4b0a0f8fda929bb621fbc390c55a617bf4fe1ad44c156f5a71a2f535a1b4f993e407b60990

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\9357B92D7A82DC731CBB46EBC4F197AB314C7C11

Filesize
218KB

MD5
10e2716ee752c06f7531baf0acd61434

SHA1
1d9e2bc98fda5cfc4a6e2cd5f8782faa5140ed9d

SHA256
1cd540d60fd7962b360d9dbfb578e34d4c8225e5af9bbbbce8dd22c6af279e47

SHA512
81845b011521b9c5b6fec0aed2410e9108f8ea1aec5f9189e54e1ceb3562997fd813e626e8020b7b07301bb45b14208a6074be24bcbd8d3e2916fcaf7e40dbbe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\958C5460C13AEFA1D0C9ED8F4AE5C4FE9A4E191C

Filesize
23KB

MD5
fbc9e8bc58e2b79fc86213c84e7a9512

SHA1
153b0f1f1753c83aa3272cade1f5de1f53d4853a

SHA256
7c92c708fef5cff7650ca8d4948d3b6d1d4f7b601a23d7061d298358428c6e3f

SHA512
0fe289962544bf9c4e16f9cb69a3c3ecff7e850c13e63a3ea482ae49857ac1e75083c1e0caa509bcd83c74e11aff581055c1117adf7f485409e65f65bf4d1bf8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\974258D4EDB32042AAF67803BF1EBC9B34561AA0

Filesize
427KB

MD5
0da80a717a98f349f1d875a55b699d15

SHA1
8b0d83c3f7364b3d82ca334ccb2f90b2fd9389fd

SHA256
1b5bc63986e75fa088a03342446d7ee878098dc4ed20513751469299656b0456

SHA512
26d99f9a7a1d8badcb2aa1f2ba6d512356ba93e5af14266912c5c1ce76edb46ae30d7b6352bb56bb6959460ec3d7a232fd721b4ad3c8e056f513875be5baf046

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\9C742E6B6700D4095EB15664FD70BF6A71A6AE83

Filesize
225KB

MD5
86418077d1f7d20c74c9fcb9823d1b0a

SHA1
c30dc2fbf68545064d488e81df6a00201c56c368

SHA256
de36cdbc17dc275c44bce5a9534417f30af057fc425cf8e0c8a115abdf012782

SHA512
dee17021cb3f04d9899fa65a37055b5252fc5182625b698990c02ffe02aad03da047c930fa0780913a6c2e488057dc55d431579b2500a5ff3320a9c3d82a97cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\9D008EE5303142C1B3E9C1FB219843A9CAEF46FD

Filesize
120KB

MD5
925713d9455a59dc08719af6bc2bf5c5

SHA1
4e769c96df344a2700df578672694ace8f45b1fe

SHA256
9c16399b5819d4e21cda91b418852616e1388e20e635c267f7e8de486e8a3f1b

SHA512
547b479f28d52da0de4aef092d0c389947431aaa454ecedd6b00eb5dc98ca3fc1db582b7fe5a72d0bfbcb69d921dbc4f0c61426a0d530211db7ffc9c4360f9d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\9FBE00593D6D8260DCA4565D770C86365743D6A6

Filesize
12KB

MD5
3dec370ecab3eccbb1b8b27f97d25ca6

SHA1
831b0e7d2348f4affa91850144ffeb68bb067e73

SHA256
10b85c93213de86740813d87777bda878d18aca64cfddc2b3f24a58188ed520d

SHA512
ea905679b56626a2f52233f6fabeefe620c1162e31fe261420fa8cc499f11d42baf44d91d9fd26cbbe7f855bfe3c989b5a11353289c8980cdcd40640aacbb090

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\A59A6A29E932AB44D22AA680C52E5FD3F0523D4F

Filesize
192KB

MD5
3ff10bcb35d3b5d722519679a2a91da1

SHA1
0d81d6b60080f943b073e71a686785180761339b

SHA256
03579c98ac51813dd3c0dd7071f683f0d0824b84c4f056ea472e0e53ec4862a7

SHA512
daa9f5ab16868740b5ec8875a2fd2082d91ddb6a55fa7a4b23ee57633d0e9eacd146f3601920917e6b3dd39694181c70e151720ec8bd1775a9f43225d73eb852

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\A79E74F56FBC41FC30FA0FC0D79C5FA2072573CF

Filesize
106KB

MD5
aeb9dfdfa13884091dc49775f0d205a8

SHA1
d84539e4948daf7a3143c2288f704a4a06de16df

SHA256
96d4d9d04acdd482f2a3c9c36fb01b7000fda4ebbbd0f647c191dd7cf6278661

SHA512
cc3e3487dc0ff422ced683a516409d56f4b3584d97346bcd5862c5874941cae68351961c0cc51e84d6fc38ebb8ac471c90dbc4bba722e910e6a60b04e3d8436f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\A7A75F8AC380CC03A0A843025ACC6711B315A371

Filesize
46KB

MD5
d4a68c3a162f49c03052cea8c7e0c403

SHA1
9830825151511c97a0e1f9f15084523b05253faf

SHA256
6fc31d73430bc910848f6bf0b8a3965f97e6f4962ef8d282695107ca752377de

SHA512
1d969bbfe3819fa549c0eb3f9913720e18ec97249e0aa875b6165e93a279bfd5183ed96be47fe2e17332b276fd8bd90c879818aecf4c6ed9a891b3f03f1995a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\AB009D058FB46FCF3774AAA1283A2F029AD826E3

Filesize
55KB

MD5
044f9b32bfeafee4f83f2e1a9c5b2e48

SHA1
90b9757738507e0260caa8c34a3a966f1a273c0c

SHA256
4151daf0656911f5fcb5ceb5b375e3ce20a58652bd99f086f09238fc2b8cb1ae

SHA512
327ac30c8afc40efcb6912c366cabff53d55e592a8486c707cc6658d165bc6cf088af3d47a562c97b814e262563c9d134a230b1ec213b1c48b3b7b0571296ea9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\AFD27FC4FCD07C83C029EF41C196DA265D0D29A4

Filesize
41KB

MD5
2082654b5875ce4fcd419c69195a08f1

SHA1
e460878ea04ad99e7521709d9f644a85b559c4fb

SHA256
3c37dfa2cd8a5ae2171570bcefc29df638fbb5da4f210c11b8ca8a3019332303

SHA512
e2f96b4c6ec60b0d2ed1c40d710d32cc8f7acee5bde31bd37f08860afa69f08e21ce0f0cc9166728009dfeee579e419254e6cb2db890e4bcaeb84244f3082c6f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\B6E4FACF8C43D96BB7DBB2EF588F459908C0816D

Filesize
95KB

MD5
0f52748862ff8b72f61d4ef2c6c2c037

SHA1
7f35d43ec42b9835df2c62dc0450f888438e986f

SHA256
749b6599e3aec489b3b7201f9992981783994837c78fb86b602b24f015fe09c4

SHA512
c5eb491739c76e7a008189f2aaa07d8cc94a0badb8aa7309f66e3549d5198083642be207f316e0e82ea5a627417ea7e0a5c5f9e5b7a50fa4f9c0ba68c093a650

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\BEFE5974E740D8747154BFAE62F365DE2D3C1895

Filesize
16KB

MD5
c907d0235f9d3fc0c75dca2a4bd644c5

SHA1
dc9cdbbd5828bf6baf17bb1f62becfb8d6108f32

SHA256
15bf57cafa2b944b6b62521fa0e3f79d83c88a92b485d7e0d0dc59bc5a2c7e6b

SHA512
f6d9ea091e1653bef8f443b65923a594e0f3a2d4ee0343886af8991729aa3afec62bf7d3ff361f386a577f72305e7bdd65ec5f6c356890556c5691f558bef4b9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\C2CBDC418A44C8EA2FB9650EF56129649ED26011

Filesize
26KB

MD5
ba0c10387c3ad5a3ddbb6ba1b0ebf2c9

SHA1
dd7690bff02a18fdc2b8a9abba674df2045a90cf

SHA256
dcc271557aad3b01411506c25b6821d788772dcc06c0e961db5192070fe0d2b9

SHA512
d8cdebfb1f5d26105e486f313e14269c8f7a8d7915681a0ee3c63b6504316a4279b2b95e7b14f2f1c06c069b8ac99f6acc453d6a20493212df5a0d77e98f258a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\C45825CFF87F338B0C69AEDA2391314C36CA979B

Filesize
1.1MB

MD5
2fecb71d635ca6519c1fd9748b321e3e

SHA1
291565d97a1925b136e7983ed0c96e97c7d2b6e2

SHA256
5f3668f6cad042cc648470ca7bc168fb35dfd6ebb37decc98ce3e454162e2610

SHA512
60eebf547aad19cff7dfb2c998e49a22835b8ef8f535cee45c499c7a0296d0d77777cbc3598ff3f0e5ef11069c13818ab4ec5e9dc15b853257df0abeea3c21d8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\C48BD0ADC63B879281A80BE3C5638191C2996FA8

Filesize
92KB

MD5
9c8807b36400f6a154a3d006ef9b2906

SHA1
facaf8932ba26ef3b2d390f4230100ea13be5100

SHA256
2a3cbd51ce67c298bf048f62fedcc9331358eb6652c65393b2b4ee4c9c1fb373

SHA512
3c466e97fbd0fdd1a90d755c3c1659f13fb95830eae652b98a4a3dd2c4ce01982a13f34899089543d1e2b9bc9b867c0f54508bb8bf79717290e3225360c93fcf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\C743C60585E5ED08BE17282AB0510FB0F267D5E9

Filesize
191KB

MD5
d412824d0b5d43260d000652ef2aacde

SHA1
2e81d9cfd727effbff0af7a949212857473217cd

SHA256
0e2d1c7bbd113af2c9b37c3c52951f87d1d05cc4fac1d763aab90b8708a4ccca

SHA512
94ddc8758696536eb730e02ac8b424487cc78bcde1bc5de7d86edf080beffa83beb2d7ca72c48f8aa3d383f288eaa580d1abd58592feeb8e5c3b8f68f786b2b9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\D12E74796CDDE8770E320801103162E84F51A1BE

Filesize
46KB

MD5
135a694790b2163ea139f30d12bda608

SHA1
9dc0053c1f0a987e393c2c70fbb88098023536af

SHA256
3bfd200225834c9de584cc48b8cb5d2dc57d76b6edea6f78d4b18b9128cf5c7d

SHA512
b624c4b57d1b1ec67421a2a6b8901eda38fd339bf5fe72982a04be7ec18aa3026fb5be7686220b4e1329f11fd4bfefad56814fa6078fd9e60a444a90a4121bb3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\D18E2BCB63BF6D4DBD7EA9DA2D5735B005FA2BED

Filesize
11KB

MD5
608eb206f23efd9b80cd4101b52d45c1

SHA1
a411180a4fced1564e66b5a35a4caed13b7680d4

SHA256
9ec8d071b742efc045d6a1f06fbf4d677e0a582fedacd8fe1f8ed45ce37c99e4

SHA512
1402ad5d7fbfe0888517ec49126c12cfc6f4ba490a3438cca2900be06969a193d47abd18cb6ea24564726974ee4afec35ab1e77e1f172f5e42e861f4041b6d77

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\D1FCA303EB63A9E8B29881B03F44862945374102

Filesize
1.0MB

MD5
60004e83bf1be8682401b1292e9cabf4

SHA1
0986fb7e174ebc10fbbb293ffc6bbf1874bcbc5d

SHA256
59202bd36ba1d7a7b14d550bcf70381aad4f387bebbbbe0a06577f07af47b716

SHA512
973d0069d48ff5db001e904fbdf16b812c62fd95ef3118990bf7074e4eda641813e713bbb4ff3f806cd70e9d11e4cf7644a7200c531d7c9201dd6c758fcfa25c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\DDA23E0601E54BB25C574289CFA9693E8E9060A2

Filesize
101KB

MD5
71b2d2b929f3a0d2f7d7095f93fbbd3e

SHA1
5b30e5d69c362d002b1099e66a9c5ec3a13d6a58

SHA256
1f85720b99e6e3c9d4a11619d563c843030a6abb65b3c42af172514dc3eb58ee

SHA512
4a8ce5b54a53523c6ad78e4b429c37c5334221672fdd69610e879547b240869eacd3e2e924318ff20a1c87b4bc7676119b344937535d50171b186c6dd7a53387

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\DFD4441A8B4A8EFFDE02C56A534A74411B5550D7

Filesize
2.0MB

MD5
35b58baabc9e737a0997855e1daf9a3b

SHA1
b4b4dbb10f1c42e823cc260293f68442aa0ea736

SHA256
51d5fb0f03657ccaf7b90cd4525f4d07f05f1933fe9176f5c1ea70d124591962

SHA512
3198da49d8c1b362544bd6f4859bb8f1ca028aa4671148adfbc564cd3a9d9e9ca792ef166a7b04c3705c367c512287dcfb93490048d7eb3ebfffe76ca1776c09

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\E97D69AF1D6132A7343C287B4F6B73FBA032B3DD

Filesize
1.3MB

MD5
7ad1cfe8866dedb81f351a0aa2c4df53

SHA1
c40de0b1d820e994a1c3ef5a4267970e4ea6d66d

SHA256
123f1b9605d2ad2c62b65c5382a8bf59bd4db4dacc7077ea0159453f77a68daa

SHA512
68028af45f26bbf1eca8f8fa14948747f3fb162a88ec5cc8679db29d52d5fef1b5c17042f38bd3abd0fe834d4603512af048d96ecb70e78ccb9f8fa848b5ba9c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\E9D679CA563776C1502C23D76870FF40DA6FABE5

Filesize
42KB

MD5
92d990ada489a7ab7c3bb64a32fa1697

SHA1
d11e27a8eedc0678e8e3afa3d9973f9b168a364c

SHA256
808a006fff37cce6e5c66829f2d558c2000a4267f920d36b5b4517c412dee5b5

SHA512
0e1a20284dc221ee6880e1ffef4054a9bcb9d8a983d97ae78ba3cb74e0cc5eeb8bcf8f060782a1ee2799baaf6abfb139d460c199b24a088ee31f2a798f5e2dd2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\EB272B5257C362CC0134288A224C1EE29E8F8BE7

Filesize
23KB

MD5
4f3dbebdf05b43dfbfba12939b189d19

SHA1
b449cb08f7ea6f7ac7775b2a8965730797e74124

SHA256
3926ef15a2a16f4bb9d9185b2708a3764b8bdd92448cf17649329fbb8c39240d

SHA512
7ecaab36b23eaff91cd8b435b8b5c79267b30585e4046f7b8234362b89481a090c3fc927324d0fc12d491bf088cd03db9dd8677bb1486451c5a66a49a171646a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\F37AE6644984754AE42B4C0DFF191F777AE95B68

Filesize
422KB

MD5
0305e5ca18b725eb77f84f2f05ebdddc

SHA1
562651ed55118f693a2306188be9a5058ee1983a

SHA256
403156d5105cb5169a4059075e3b39f3318ec5c5c2a0da175135d92f60b45ef9

SHA512
39e708585b55f512045157966053dac3237814ae95916de03d5758e61b228f40b791e63b0ce99bb7611ebfc38456eb4110d20f2f9cd9cfd10540cc96252d93a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\F7657EE11EBB52AFE15681C520ADA7F87CC99EAE

Filesize
1.0MB

MD5
7e5c8e94d048e148906b8419f5993803

SHA1
34d4f901286cfc218c7665810f7493b8b71eb065

SHA256
1489c66c1c423595db888846698c9ec6641794b8cf72ba052e1849eb668fbc81

SHA512
12bf3d0fcb388b2b067c5c1ed3697321e385daeeec7c384664ce1f9bf7602e3c85071932f257dfbb47182efe16e6a33812d33d985268ee5452a62f4bae5f6d9e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\FDC533421C8D2DCB98DE738D8A0272403E7E4EBC

Filesize
60KB

MD5
acc2cc88f6750cc243baaa9dfb36f495

SHA1
e10379d6a3e74929255a346d76adebd2acd690ac

SHA256
a6e31dcaaf5f1dcfd1bc1ffdbc00bb263a1716d6a59bbc68d62acaa6ce76992e

SHA512
d0e36519e2ffca88dc944f9ea6bf190e510d3cf5183936ab3a11400730af635c4bab20a26fcc8916d3f61b7a0c92e78440f5519384a5cad47a8bbb08893c8fed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cookies.db

Filesize
20KB

MD5
6c1c55d681aa1d1db9a24c6cb24ce1a7

SHA1
0f1210754775ec71a8177f198265a70d561e3708

SHA256
fcd3438e34922bafff076a860fdd542edc3b08fcea88903e6ddc21abdf4a08b8

SHA512
063a3dc66a7c1b10ed8a51c172a3339515fb8b6175f002b5f85f58c1907c1fa401528e935127ac3e1c2111c50133a7743bd4d48dbb09b5598ec01ca45db365ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Logins.db

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
92KB

MD5
64408bdf8a846d232d7db045b4aa38b1

SHA1
2b004e839e8fc7632c72aa030b99322e1e378750

SHA256
292f45b8c48293c19461f901644572f880933cbbde47aedcc060b5162283a9fe

SHA512
90c169dbae6e15779c67e013007ac7df182a9221395edd9d6072d15e270132a44e43e330dfe0af818cf3c93754086601cd1c401fb9b69d7c9567407e4d08873b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21082\attrs-23.2.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
2443ecaddfe40ee5130539024324e7fc

SHA1
ea74aaf7848de0a078a1510c3430246708631108

SHA256
9a5892ac0cd00c44cd7744d60c9459f302d5984ddb395caea52e4d8fd9bca2da

SHA512
5896af78cf208e1350cf2c31f913aa100098dd1cf4bae77cd2a36ec7695015986ec9913df8d2ebc9992f8f7d48bba102647dc5ee7f776593ae7be36f46bd5c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\_decimal.pyd

Filesize
104KB

MD5
e9501519a447b13dcca19e09140c9e84

SHA1
472b1aa072454d065dfe415a05036ffd8804c181

SHA256
6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c

SHA512
ef481e0e4f9b277642652cd090634e1c04702df789e2267a87205e0fe12b00f1de6cdd4fafb51da01efa726606c0b57fcb2ea373533c772983fc4777dc0acc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\_multiprocessing.pyd

Filesize
25KB

MD5
849b4203c5f9092db9022732d8247c97

SHA1
ed7bd0d6dcdcfa07f754b98acf44a7cfe5dcb353

SHA256
45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807

SHA512
cc618b4fc918b423e5dbdcbc45206653133df16bf2125fd53bafef8f7850d2403564cf80f8a5d4abb4a8928ff1262f80f23c633ea109a18556d1871aff81cd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\_queue.pyd

Filesize
24KB

MD5
0614691624f99748ef1d971419bdb80d

SHA1
39c52450ed7e31e935b5b0e49d03330f2057747d

SHA256
ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d

SHA512
184bc172c7bb8a1fb55c4c23950cbe5e0b5a3c96c1c555ed8476edf79c5c729ed297112ee01b45d771e5c0055d2dc402b566967d1900b5abf683ee8e668c5b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\_sqlite3.pyd

Filesize
54KB

MD5
d9eeeeacc3a586cf2dbf6df366f6029e

SHA1
4ff9fb2842a13e9371ce7894ec4fe331b6af9219

SHA256
67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29

SHA512
0b9f1d80fb92c796682dba94a75fbce0e4fbeaedccd50e21d42d4b9366463a830109a8cd4300aa62b41910655f8ca96ecc609ea8a1b84236250b6fd08c965830

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\_ssl.pyd

Filesize
60KB

MD5
fd0f4aed22736098dc146936cbf0ad1d

SHA1
e520def83b8efdbca9dd4b384a15880b036ee0cf

SHA256
50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892

SHA512
c8f3c04d87da19041f28e1d474c8eb052fe8c03ffd88f0681ef4a2ffe29755cfd5b9c100a1b1d2fdb233cb0f70e367af500cbd3cd4ce77475f441f2b2aa0ab8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\_uuid.pyd

Filesize
21KB

MD5
3377ae26c2987cfee095dff160f2c86c

SHA1
0ca6aa60618950e6d91a7dea530a65a1cdf16625

SHA256
9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b

SHA512
8e408b84e2130ff48b8004154d1bdf6a08109d0b40f9fafb6f55e9f215e418e05dca819f411c802792a9d9936a55d6b90460121583e5568579a0fda6935852ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\aiohttp\_websocket.cp311-win_amd64.pyd

Filesize
19KB

MD5
6af681a880d0b41ec16d38f8d7603578

SHA1
be92c953f7b4f19763ac768ee961933051e6fcb0

SHA256
1211eb2986835d195bc7b80e16f03d5891d7088fe0c3ef19c41c55c517a4082e

SHA512
5a38db40a7a0540d77618d3dcd2cccacc9ec3a4c4084bdd113ababddfc0271f392d0356f0310e6850fc919b5a02099cce9b2a1490e79ca427784824f188a80c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\base_library.zip

Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\libffi-8.dll

Filesize
24KB

MD5
decbba3add4c2246928ab385fb16a21e

SHA1
5f019eff11de3122ffa67a06d52d446a3448b75e

SHA256
4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d

SHA512
760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\pyexpat.pyd

Filesize
86KB

MD5
fe0e32bfe3764ed5321454e1a01c81ec

SHA1
7690690df0a73bdcc54f0f04b674fc8a9a8f45fb

SHA256
b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92

SHA512
d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\python3.DLL

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30642\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\attrs-23.2.0.dist-info\METADATA

Filesize
9KB

MD5
e32d387a89f0114b8f9b9a809905299d

SHA1
a055c9fbf5416c83d5150d49ca16c58762b8b84a

SHA256
5b0bc6ece1f22a310fa72154642098b759f413f09ca9d45bedb96218475c9be0

SHA512
6eee3e19af46a79e2110678f8d3d15ea4b2eb1355d0fc9581da2c8e91d28926a2771394ea447e15cbc311a9dd9de2a20e2ac0e0abf9db6d4d51982199a12e881

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\attrs-23.2.0.dist-info\RECORD

Filesize
3KB

MD5
0461ab56c7d588c2d9596f91e16658ec

SHA1
013e2923cac817d68ee9ecf9a812e41707c4c7fd

SHA256
a6de30062543c20b137871403f784f12622118583313e9288a9389c005de59af

SHA512
dd217fccdd005ec00c34621edd879a6dac57f11065ddd628d0166fc3f2d78f32e282cca86aeab71d80928d834657a1e1d8d704f2a3bef98410ee2d2e614a9590

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\attrs-23.2.0.dist-info\WHEEL

Filesize
87B

MD5
c58f7d318baa542f6bfd220f837ab63f

SHA1
f655fc3c0eb1bf12629c5750b2892bd896c3e7d9

SHA256
99161210bdc887a8396bf095308730885fffd007b8fe02d8874d5814dc22ab59

SHA512
3da6980a39c368ab7f7527fcd5fcdaa9d321060174baae163bf73f8052a2ac1a73f476c3882855965dfc2cb13c7c3ec1a012882201389dac887f9be59540c80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\attrs-23.2.0.dist-info\licenses\LICENSE

Filesize
1KB

MD5
5e55731824cf9205cfabeab9a0600887

SHA1
243e9dd038d3d68c67d42c0c4ba80622c2a56246

SHA256
882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

SHA512
21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography-42.0.7.dist-info\LICENSE

Filesize
197B

MD5
8c3617db4fb6fae01f1d253ab91511e4

SHA1
e442040c26cd76d1b946822caf29011a51f75d6d

SHA256
3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

SHA512
77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography-42.0.7.dist-info\LICENSE.APACHE

Filesize
11KB

MD5
4e168cce331e5c827d4c2b68a6200e1b

SHA1
de33ead2bee64352544ce0aa9e410c0c44fdf7d9

SHA256
aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

SHA512
f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography-42.0.7.dist-info\LICENSE.BSD

Filesize
1KB

MD5
5ae30ba4123bc4f2fa49aa0b0dce887b

SHA1
ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

SHA256
602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

SHA512
ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography-42.0.7.dist-info\METADATA

Filesize
5KB

MD5
51e28e442ad9f3ca86fc022806f6b860

SHA1
ec18e5a627febf6fc10fd28f77f03abe0d45f1d3

SHA256
c783b299bf4110de7f94a7da362927657dd1cd0631b00f2d7a2f1242ff4c3a1a

SHA512
a2d54956de9f2a896b270a6f2f738f1c83f13ebfa013ca21c7c8de2c02109065eb8feee1e1c4b5593a3a91eeba5caccf24d174fe7e098a61ed73949330a94e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography-42.0.7.dist-info\RECORD

Filesize
14KB

MD5
4f2cfc5384332d99419cf2ac48f02a69

SHA1
7e40c9562dbedf8be1ec5d97b35da2d58ebe727b

SHA256
e989319379a5fa8829311cfa40f1eb78b110011cb8ec5fa54ee554cab4521110

SHA512
932ee85656930a751e961ac736859c6c5c869879fd48ff288ccaa42221cdccfe839564834f128e406876c1ffbd2e54580d7b69285e57b58f3550bf8209b21220

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography-42.0.7.dist-info\WHEEL

Filesize
100B

MD5
c48772ff6f9f408d7160fe9537e150e0

SHA1
79d4978b413f7051c3721164812885381de2fdf5

SHA256
67325f22d7654f051b7a1d92bd644f6ebaa00df5bf7638a48219f07d19aa1484

SHA512
a817107d9f70177ea9ca6a370a2a0cb795346c9025388808402797f33144c1baf7e3de6406ff9e3d8a3486bdfaa630b90b63935925a36302ab19e4c78179674f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography-42.0.7.dist-info\top_level.txt

Filesize
13B

MD5
e7274bd06ff93210298e7117d11ea631

SHA1
7132c9ec1fd99924d658cc672f3afe98afefab8a

SHA256
28d693f929f62b8bb135a11b7ba9987439f7a960cc969e32f8cb567c1ef79c97

SHA512
aa6021c4e60a6382630bebc1e16944f9b312359d645fc61219e9a3f19d876fd600e07dca6932dcd7a1e15bfdeac7dbdceb9fffcd5ca0e5377b82268ed19de225

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.0MB

MD5
2fcce5a4be27c1f03c07f28442c519c2

SHA1
720309702539887f00b604ef9482e6f4e90267fe

SHA256
eed558d5a0fe7cea03d6b52950594ec8a7c2e451daca1018118a7c640af4990a

SHA512
71629b36b48bb353b7cd97c23cef116a006a61582cb7064e38cfd6e0769a8f8edbb51e7e141e365c0be2dbb0985cb3ef3cc0f0d3fd4eeb32322f8c406352b4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI52562\frozenlist\_frozenlist.cp311-win_amd64.pyd

Filesize
35KB

MD5
15b0df96344baf6a4c72766721943e52

SHA1
a3666e88594d1ec97de23b9242f346c43a34c070

SHA256
abb6f497003738db2407b01dfa0abc61f6bc7fdb2452c52f76ab11f5430d844f

SHA512
4fbf295d0882646b8c4b3284f11331fb12767fd1404d78d3e4d88a434896058c2df05dd1a2d9c8ce696d2d3aad8c7251d00d95c399df2e8c11bb319f87a4385e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_32d43y1p.2ho.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
11KB

MD5
9f816973fdf6887fb3b740b836d10b79

SHA1
12ff01000deed2f2883b1b87142baecd8935a51e

SHA256
c092ef923ba0b13d1ad80baec4c18c28e42d774837e9c20eef53f54606edb778

SHA512
36985fa28ac82863c0656f82aca930ba100f10fc43d1dc7e1b4a1730b23c2f5bc97a8cb87ac2cb72f616b2a9fe213b4ae703ab7356b6985e556813c97e6df5b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\crashes\store.json.mozlz4.tmp

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
f1be93f7540a2676acb87f7741c21cba

SHA1
25180c2861d14a459eef202be7c2550447b214c9

SHA256
156cde480f9100ebfa79f0aa1c532edce505742adc4bba3357f964e14a7b032b

SHA512
dd87a4ed5544fd55ef6d71ad76a4af18e3ca137c18ba05ba67ef520bd8748775934773f6f75b7184a10f8ca67e13f9b5703150bd0f710a9672ae33632d65b209

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
c6b4cf4bd6f604f5a0aa8a548d7fb629

SHA1
14f49140373589549de6537c5a0304f8f8640b38

SHA256
0162aa417472df3b717e4ec12d4bec796156926c18ce129253b25ac5d3ad6422

SHA512
a8bcd5e71acb163d05418adde5748e0f57f25c35a60f61450dc370eb5afc50289cc94209e1ab05cf8f08c3abbe61a89ba5dd948ecc8c953a459b5f8337ccf3b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\2b4cae0a-14c0-45c7-b955-3c944e8a35f4

Filesize
594B

MD5
dcdd8ae8b223b1864946991ca49952c2

SHA1
a6b36e478ef11d29d100adf1b2b34076cafec80f

SHA256
4da22331e96da987404e40f4705a8ce9bd56433025cba036049082e2d28a1265

SHA512
d8437d3a70a4d3bd93b059a680bad32b7ffeb00d0c57e98b0eb81985e1da4bb95a5e010191bc74f0b60ffe8aaf0dd65850703b1bfb1546f3c1e7e4d224de2cec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\5bfbe100-e533-42e1-b1c5-3477b0a13593

Filesize
746B

MD5
1683bfeae9a550778da8d8bebc988cdc

SHA1
ed4f0383b1c6704b65a69dfcb48a98c8fd4afad4

SHA256
44e293accf9bc2a73237e07239edb9d18ddf7ed147aa2b3570c36892ff89071e

SHA512
ba55fc1f5a67617866cd8960f81b512fca95fb4403111c0fc177dd6bf1bc65369bcfd072f78082be894dc95d6e0334e9fdb6433cb33c88d0b8e2533a2c77d8ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\ad34431a-1ea3-464c-b39e-70b64adc5ceb

Filesize
10KB

MD5
5489a619ff26c7adeb3a025232d9ba17

SHA1
e4608a62533023b741ec18a4ce0173c8c17ed8c3

SHA256
e708be47fb64cf61e171e4be750726bef0e0e84ec498e66d6600b21001493dad

SHA512
5950bb27e8a43041657a9841033a9559f9b288d9d6be8a4b87ec502ac30c5581d69b389ed8c27dd4f53fc6a5d693a03af61bd50d541cc79cf0e4af63d5cc5654

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\f30e3fe1-a444-49e1-9955-bba4f1816b2a

Filesize
657B

MD5
59528bb7cfd19c1e5b636d097df78123

SHA1
ef36b690126e90d1366ecb260d0e68bc8479e797

SHA256
b8e7bf402c43c619d2be2d3bafd46ed796b50f1be1cbb31048e0d7ff73e7a0f6

SHA512
25fe3e528013d0ad223978d8dc8c87c9e055741fa5271b324efe91fa8cfa6ef6a9b0fc3f656cd5f4d66fb1cf30e0ce3e18609527d2d3bedeed8263b9534df2e5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
7KB

MD5
cb6c3d0744d509b782e9b65790b40345

SHA1
f6a882bc7ad8b359fda34d4926ca4e6c1164f72b

SHA256
3ac46a8277047e8d8152498d20e55b5e70a9b70c087c9063f308eae26330e4fc

SHA512
8d2b0fef52fb159e62de9383fefa66fde10569f375b672fb7a689c78b70da28376415405dad9f42c7d085cde46c182066b067018e2419294d80e0a295cd78504

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
911439c8a9083f5a8bfc7a0dc230fc11

SHA1
ebc1edadff2a93356abe53a365ae01c8c8f2e75c

SHA256
f6ba679f9d87aaade42e416cfea75c10a36e009bd811b4526425b24bba4fa30a

SHA512
c63c7c1df9e21bf987b8ef1da5640cb8aa1fb427c5ae2b947915fad3d8bf59f0c549fae83dd56b0e56b67f40490e8132a60e47e1969a89f298e0ba23b347a010

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
7KB

MD5
86026a588dc7f2f7420e5bc3e2c39a34

SHA1
302236056eda7e1e24492cc3a78aa3917ea09729

SHA256
f5f420f9fa4f6dbebb7a9d25bc67c5494d2d373ab1d55e63a02ba7d758e57104

SHA512
6933fe6b96fae3af215152e949fb0db2a3327a858ac3643c23d6653349e64fb02196bc82a7af033906cddcd0fb0a20502f6e5e54d80ebfdf84cbceeed328cf1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
cc7e17423b418adb551dca2c1c2dea24

SHA1
c535a3afead50fe8ec42d8caacb6cd6945e9aa37

SHA256
68e16cebfb3624b3ab8974c79ca427278467e317284dd15f263fcef72fa49600

SHA512
a7064ea5f5b1fdd1bd3ef965e778852c6e5b33c6a8e3038826b40a5fc1cf9aa780e95c7cb0a9e5431242559e0a34c1fd4b6015f75b8e82403850aa17b51c3c41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
589e295da4200a37bcd76f9329c0d1c4

SHA1
fe6c3c339f2bc89bd1ce3b8025f821e333c9519d

SHA256
c7b0040beafccecb1a9bde7c98cf0926cdf2a9897c10e8ac7f5e522a5c705bdc

SHA512
56394534c9cf7443a5c0aaf446194aef6e17ab6a4a8adb6faa9c19e42fb1d3d2e2f384e5eb51ae20b7db59e73595de062b4a4acfe6293cf42226e1d28bce76af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
0817c5f89960f297fa22ce95536d6107

SHA1
4433d820e6bad45d23423e6ff3233406fede3c51

SHA256
fd1ee258d47c9f497b629d080a0b8cc9b4e0bca1d0a6fdc6997fe6d1397eaca9

SHA512
ce571a3e2c6c246d42d0b246dcc613933db1c5d758d2fb8532bdd048b0e19483c2974382f5010b200bd3054ba2b878060e76bb015f6de0fb9bcd2e5765b00e24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
b39f027d7656a99034d8619e7c32c049

SHA1
051fb864417c742ae111ae470513546f86ce2900

SHA256
26814f1a5a2e014167b9c24cddefd28cd9a8696a9dfef04abb03a2ebd3445bbb

SHA512
c85c45e2a6ccb45dbc7f6905c2c534e273f3de4d25325d1ebbb9f4b936e1a760dca98203336f04335336e2e7566517393e065434f7fe239e57d463d85a14f5e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
ac51ef013e0fbe5f209222c315bea4b6

SHA1
4910a3294957eb4ff42acc54958cd2759020f05a

SHA256
99f1f84c1ebdf04e00fcf89e97935b82bf5d8c4fc240e87b0affc1a39ea7d767

SHA512
457b4035cb5faea656f6960e8fd3f157dfc928916fe909c445e5dbee675597d8c0e94e030ef5b424745d884a9f75e32be4e92e266ffa580970b2a54b7f0e4152

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
7ee6056b80b5f5f9654b0ce6cc50bea2

SHA1
4de2d98bf374b3c7465cc87fca61b90a347109c6

SHA256
87703677cb53c784341fbe05280e5e297be191552dcca9efc7c8683ca4c3f0e3

SHA512
4f7e1d5aac24140473e456992cf1a1d0ab9d014dd41651ed2cd16abe96ba1725928069d81a0b514345d063b65885c11b84c27d47a16af9685ead6545ac2d356e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
185c8ece14db124eefa4f9eb3a634734

SHA1
cb070d87e04777d2337c6704509922596e79928d

SHA256
3138f870f08c110b4d9a1bc48a9962c4aff0bf3f5d0b3d700deaa82216cbca5c

SHA512
b46157041b326f536b0ed71ecfc494eae41f06e75588e2f96ad7509a35da6ca07eb9191761cc8ac8ae536b7d8c37375b8b6886d050c2062d8625687b0033d9d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
1c78a5a14a0b4a927bad79bd6d588132

SHA1
9fab6dd973092ab778e5a3dd2c6f2a7a023d8ccb

SHA256
1a628dc41441b2f089cabc54ea4278cf1c35e8ed5468ca6687fe0cc50407997a

SHA512
6b0943fe6cd398d31087ce52eb0d2394cb32d25ab70888d6cea6dc526ed5418e9833110adff26ee7bbcd68c934d16ba698dd0c724d8950653a7a6012550bb81c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
bc3985e83f0f445b1f657aa75c09db0c

SHA1
1239657537a9ae8e6f023350938036ad57e10ed9

SHA256
53e7d61d37dd2d368baa71cab59f912e85080be72a6cf09c7a422d85ef11fd4e

SHA512
44738df74da091f17d744eaf44aa73a867ab230eaaba05e634814488d33409b6da5da43f80dd82b7af67dd9ef6193cf8a7f842158f707e483264d6630ec53a07

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
5f3a1ad9bb43159a83724af12874ac3a

SHA1
ce511d98274bc0ded77bc1b9968872d7894f7257

SHA256
df48f685e687ef2b5a909c27f01d2c602fe05c410471eb7630a3cead91458346

SHA512
d7a0f641cebdc921fd32406a99d2a6a6d261f152cbe63de46f87cd646c0790d45f8988eb78108eb42db8774630cc447686156d62d8241b66900cdc5985158fe3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
950a276a4bf8fe960bb329e0501ebc22

SHA1
56abd9aa64263959b03da4184d5bb76f464341bf

SHA256
829f35f1f5f8591c78a9811aa82b4b0d5806ace2bb0e512b43241eda74d2a2e0

SHA512
57f09980469c6f30910ca49792448c81780a47b0e03b38c5e3448824df2c822ae2f071e6bba9d1d38bb51abe2c0b5672f2100f6154fb37e808690af3e9c5b57e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
b6aa0c229ecedc3995c6d77023f736c3

SHA1
abe4ede934faa5da8420abc0ea8f3a171dc9251c

SHA256
7f50f2ea5af66406a6f785ba7b32b7b5bfd451991025513623230d8002afba1a

SHA512
c98efe31671c39233c2ddceb833d564bd1258f268cbaa8af5c11e1ab785f1ddbdc4601c6bb539a8164fc96cc7f379da295a32b464e8ee46a2edc5a6e49743858

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
e1be25045d319db1202ef8afad6bde99

SHA1
25f6ce9ae85559c5a4e4f752d13a9f6c10ac7d0c

SHA256
a64d9afd924b545de4e58211f7c413c2418569e88d168dc25bda277aa31313ad

SHA512
d0feddc773e37ab65ed9ed3307a9d05cfc57841c2eda628559b34c2ee9aa5d7e2f9fd1ca3560f13c338c4d039c9b76381afe533ac18885667893245938689cb4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
4fcb8b373985990be651a00e6cb73835

SHA1
86e8b46181bfe348cddcb92af970abcf863e24f8

SHA256
995e5cdc5df6abd0f521654cb469cc4fb4196e4c33ae4ef4d93c5d90253efeca

SHA512
e2fbb629b4ff76ee5fff28d6f4cdc270972332d6a42a51ff33b6c612479d8ffcd6c719a71842465072c7efb1f066580336963a00ed09ff40dad05db14807cf9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
8KB

MD5
b075bd16e43de36d36f354e1e6bfb697

SHA1
36c298d5dfa129d7e6056cbd047f1c623144ff47

SHA256
a5ba94903fee90c99f4de7d038e97df6699af95ae544418ca76e0dacb3185b08

SHA512
5993dbe3cae4a8f98af93422e1ee6918c00ea19e4a72939380f0324b1c7d7fd2d0902683fa03329cadba17c1c89861f3ac2389f0fefc9d71a90762b3945b0dcc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
fd09f9dacb9710d3178c4e8d67bb19b8

SHA1
f997f57734bb2891ad95ae3c8ac0908e7a0c9a97

SHA256
8318eb77d60f6c165f80e2956771019db957237b440ea96255afbe1f2ca92ea4

SHA512
69f86ed49b2c98df6d27c01fa2d50da79bb7b0b420a4f03909f4f566c3c789877e70a14ab58707094c10be55607a8f4a355c542d6bab514046d8fdca9b0faba0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
5a8ff2b2e9883ce65c1b6b96bd7c97e0

SHA1
96fb101c83bda4e93b042e6484dcabdaa0109a1b

SHA256
316c7a4d649e6b55ca1d75fe993b5464f29d11e4ce104c99ec3707039d05a988

SHA512
cdbb28c0fa3203929d333101fe99980fb83f923f045f4c07e0d84efdad092b88c59af4defe9c1f0401f47cb23798826639f5ceb9c21ac51fd1ec44e884b93e08

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
b4d800d8b6f2bbc24c99fffd3aea9cdc

SHA1
40e30dd7afc89cedefb48339dcb83dfb4438a9f3

SHA256
12035df6145a014fe1a8c380be7f1ddb51b7eceb0b166fbde443867dcea6f258

SHA512
bd02e98471aad41b7458ae0af6ae2e8c257dcf52c76ae01e46c1304854b1dc7495edc2f424f21f5d2575ba837892fc109c678b5c16243621defc7ca750ddf98d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
a1470dd6025f1d40132709745c8992c5

SHA1
faef45cc43e53cb7d0fe4892952349bba2694e4b

SHA256
3c8387dfab3e357f24c5271d3da1524e8677f297572f3485c29236fef4702c6a

SHA512
946d12f08994fae4148949ef517a62116859d63e678191c06c2ad14c2dd3d449241a8ed1438baee7874f61c6163db35a35efdab99a5224da410c17e5a93da509

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
266564b91829d56e05034d5e97bf70d7

SHA1
eaa4f40f1e481e7b415a250a858e53f8f62da724

SHA256
7cde5e9b811bc4c5d4454af05be8d83917a70f5417c691fd1ce3994add3a75ab

SHA512
e639f2dd099ed5636d2647969458b470e997c13735a2e41f45e774f1fdeb968a4267e23356bdc578f2ad23004d2d165803138318b8a10c30aef97ef0a8393de2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
20790a6a18a3c36d56dcf090cd69cf0f

SHA1
d011571fc63b3f1347761e6ef246c3ef49ec545d

SHA256
fc22cc69665b41ace69d32c85b30583624f9426da8d86c66a9f2a969b73923c7

SHA512
6783b78d51ff18bcff4cb26460866dbb26e2dbae9fbc947c042efb3e0422711ceb9fcea6a3bdf32de45ea2273569c71cd41fec50004d033c86e66464677dc369

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
5KB

MD5
78f6dd48667ed2d155457c6a7d07fa87

SHA1
4066788e659eb008833f2fd65ee4f64d36a1152c

SHA256
2767c30c667c7b1287cbb52422764106c1e60f443cb1fd52c96cc001f08c94e2

SHA512
340cb439106ed0e56aa7a1775d324adde64a5d340628ef059c5ecf43babdcfbffd5ee881bb6414435e35df76ee532fdc6444d6d98731640d13cfa05778c5b651

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
6KB

MD5
d3d751a76e24cd7ea24fafa8303b398a

SHA1
e55b5482f153d2287c8dbd94694176fffb058f8e

SHA256
02f3a50baa18ee1126d25de13e4dc00c98d496b0343196eccab5af7b6cc4c2d5

SHA512
8395042f9c3a07d72704c420df8156af2021d5047091b96b4ffaf4bcfd3e9b916391e2c3ddca17c9a67af88c5e33c54c74f050d0aa05245c808a927ceae2044b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
bad01476f5c9a53a362560271421ecc1

SHA1
5f6d1c7dc7c9962013e73d23e854202eb54525ae

SHA256
6deacd0fca696c51d295d8b134d58dd6f1b3e15a91cfb44a8182b8d27c3e3235

SHA512
a32dd847284a8e936e90c86a95d553b5363d6b2e6c01aeef15770f8da0e057d51c1b75dd083f49c8589955a86e7b1918a3ceccdffc49bfdbbf22e15b0c3387b6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
6fb529a6040edced72255baf206751b3

SHA1
d86a9e27b28d30d06bf0134fc1f1dbe1c8eddde2

SHA256
0854a410ae1d03645fb10f650df8a76657332b00ebb80a86b3a2167e305fa970

SHA512
b62f30ad4cd0801c044258e0c16ffce4a945f4f94b1352caa03aa5639c0d7efc971e6b32bdac81eeb79d02715dfa4deec490f2e385f00b40008edaa6addc4020

Download Submit
C:\Users\Admin\Downloads\Vape_V4.i_Wfwu3Q.rar.part

Filesize
16KB

MD5
240ac2f42a6840c38a35c94cd1ff1d46

SHA1
88b70c1e7cc73606ab8990b94eb44230398731ae

SHA256
22d367c666948529d2a2b2211fcd3069af24d4c9bf31607e304d377ac2f230bb

SHA512
e47367a1c9bca5d9cf13bb29b8d74a38f84d7039d36d8d7454ef356ab35683063e920250b2f8f991615e37bfbbc50f43176067c66e2bdefa1a252d1a584bf817

Download Submit
C:\Users\Admin\Downloads\Vape_V4.rar

Filesize
14.6MB

MD5
029504c15b770ca7db29eeb7a9334103

SHA1
3dc68216dd75954edc70ec6037563b7b803c9949

SHA256
8531f0e00bd3595777a4e76832ed81c932c69371b5be79b9b5a5cbec8f9732e6

SHA512
8e08daa74c1c32f488cbd665168c6b58062b24556da9636d3e83c498640069b737639b19ccb367f26292bd7914496983d06bc4476d849af0d2d9aec3bf7a6d20

Download Submit
C:\Users\Admin\Downloads\Vape_V4\Vape V4\vape-v4.exe

Filesize
10.9MB

MD5
ad07bfa01647246e1094bad415b7c9fe

SHA1
51cd9eeddbe7cc6499a15140bdc6b135d7617ef7

SHA256
6d36b308afc3173e03f00b2e3666d596b2a12035bd6dd6366e68799fcbacae59

SHA512
14217a65a36697e42c142c0a30b6f54d9d8c20f9752f7300f0d5149d88a823acef45759c5869cc66679661e2680be2ec0cb3ed98a64dab617a01d0180cccc900

Download Submit
C:\Users\Admin\Downloads\ZGJA9JbN.zip.part

Filesize
6KB

MD5
a003e87598801f723db6a2471f0820de

SHA1
eea86e62ca932d1ca79695fa561322661dfbbb9b

SHA256
e9184337cfa22667bcd36a9b7b4c6e31485fa583955ebda1726135c1bb2a207d

SHA512
ffe557e468e7f634d8a25ddcbc9437f4a8fb8311be86314170e31099733d7af645d0a64a394cb2372f983d7dbe7fe84c59b68e620116b58ecf424465879c2bde

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\_asyncio.pyd

Filesize
34KB

MD5
1b8ce772a230a5da8cbdccd8914080a5

SHA1
40d4faf1308d1af6ef9f3856a4f743046fd0ead5

SHA256
fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f

SHA512
d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\_bz2.pyd

Filesize
46KB

MD5
80c69a1d87f0c82d6c4268e5a8213b78

SHA1
bae059da91d48eaac4f1bb45ca6feee2c89a2c06

SHA256
307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87

SHA512
542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\_ctypes.pyd

Filesize
57KB

MD5
b4c41a4a46e1d08206c109ce547480c7

SHA1
9588387007a49ec2304160f27376aedca5bc854d

SHA256
9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9

SHA512
30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\_hashlib.pyd

Filesize
33KB

MD5
0629bdb5ff24ce5e88a2ddcede608aee

SHA1
47323370992b80dafb6f210b0d0229665b063afb

SHA256
f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8

SHA512
3faeff1a19893257c17571b89963af37534c189421585ea03dd6a3017d28803e9d08b0e4daceee01ffeda21da60e68d10083fe7dbdbbde313a6b489a40e70952

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\_lzma.pyd

Filesize
84KB

MD5
bfca96ed7647b31dd2919bedebb856b8

SHA1
7d802d5788784f8b6bfbb8be491c1f06600737ac

SHA256
032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e

SHA512
3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\_overlapped.pyd

Filesize
30KB

MD5
97a40f53a81c39469cc7c8dd00f51b5d

SHA1
6c3916fe42e7977d8a6b53bfbc5a579abcf22a83

SHA256
11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f

SHA512
02af654ab73b6c8bf15a81c0e9071c8faf064c529b1439a2ab476e1026c860cf7d01472945112d4583e5da8e4c57f1df2700331440be80066dbb6a7e89e1c5af

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\_socket.pyd

Filesize
41KB

MD5
04e7eb0b6861495233247ac5bb33a89a

SHA1
c4d43474e0b378a00845cca044f68e224455612a

SHA256
7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383

SHA512
d4ea0484363edf284ac08a1c3356cc3112d410dd80fe5010c1777acf88dbd830e9f668b593e252033d657a3431a79f7b68d09eb071d0c2ceb51632dbe9b8ed97

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\aiohttp\_helpers.cp311-win_amd64.pyd

Filesize
26KB

MD5
cfce0b2cfa84c1b1364912e4bfa854f0

SHA1
92ddadb37b87f54c2c1a244cab0b51b6fb306ec3

SHA256
4c173e67e018db851a1ccbb21d9163c05b11445bbeea44e433bfe3b900c82e9c

SHA512
932a0cd07b815b5cfa460651c058443454313de96c694842e0d22bbfbad3ef2b044624e689dede8409182cddb77583de22ab2c1fdbe48e69ef4ebd390bf80781

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\aiohttp\_http_parser.cp311-win_amd64.pyd

Filesize
80KB

MD5
8fa0c4c34ae5b6bb30f9e063c0d6ff74

SHA1
81172f9eeb5ba03575232d6c58ee1ec5488b53a2

SHA256
89651d43c08734e0b06c9869446461d815ea0d59dcafdce340920267108dd218

SHA512
f4e122b46e364711bc2cda034c845369673a2d62b9f2628685e420ae8697fa42ce9e2f678f9030703ecf24fbfcd6cc3e8f7d23aba5f127c27d679051d8db1f62

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\aiohttp\_http_writer.cp311-win_amd64.pyd

Filesize
24KB

MD5
5588be68b4025d1f7d44055a4a5bfb3b

SHA1
720ac28b851b3b50b058813c67c364de2ee05cb3

SHA256
dd82daaaef6677270b80ea23d8dd9bbb62bc8208c2f243e52abf97751fc94f48

SHA512
cdf635f191f5994f4e4cc5373b964a5db674abea144a36492a958b0181b85c85bfed0162eb85d130f822e0d6b0f2180144920dec356659ad47e475ae70ac9bb1

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
eeaded775eabfaaede5ca025f55fd273

SHA1
8eefb3b9d85b4d5ad4033308f8af2a24e8792e02

SHA256
db4d6a74a3301788d32905b2ccc525e9a8e2219f1a36924464871cf211f115a0

SHA512
a6055d5604cc53428d89b308c223634cd94082be0ba4081513974e1826775d6e9fc26180c816d9a38fead89b5e04c5e7cf729c056bfae0ed74d6885c921b70ad

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\select.pyd

Filesize
24KB

MD5
c39459806c712b3b3242f8376218c1e1

SHA1
85d254fb6cc5d6ed20a04026bff1158c8fd0a530

SHA256
7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9

SHA512
b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\sqlite3.dll

Filesize
608KB

MD5
895f001ae969364432372329caf08b6a

SHA1
4567fc6672501648b277fe83e6b468a7a2155ddf

SHA256
f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7

SHA512
05b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\unicodedata.pyd

Filesize
293KB

MD5
06a5e52caf03426218f0c08fc02cc6b8

SHA1
ae232c63620546716fbb97452d73948ebfd06b35

SHA256
118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a

SHA512
546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI30642\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
40KB

MD5
9a8f969ecdf0c15734c1d582d2ae35d8

SHA1
a40691e81982f610a062e49a5ad29cffb5a2f5a8

SHA256
874e52cceae9a3c967bac7b628f4144c32e51fc77f519542fc1bac19045ecde8

SHA512
e0deb59abef7440f30effb1aab6295b5a50c817f685be30b21a3c453e3099b97fd71984e6ca6a6c6e0021abb6e906838566f402b00a11813e67a4e00b119619f

Download Submit
memory/2012-648-0x00000199195E0000-0x0000019919602000-memory.dmp

Filesize
136KB

Download
memory/2012-651-0x0000019919790000-0x0000019919806000-memory.dmp

Filesize
472KB

Download
memory/4396-548-0x00007FF8BE880000-0x00007FF8BE897000-memory.dmp

Filesize
92KB

Download
memory/4396-498-0x00007FF8CDE40000-0x00007FF8CDE64000-memory.dmp

Filesize
144KB

Download
memory/4396-444-0x00007FF8BEE90000-0x00007FF8BF478000-memory.dmp

Filesize
5.9MB

Download
memory/4396-483-0x00007FF8CC8D0000-0x00007FF8CC8FD000-memory.dmp

Filesize
180KB

Download
memory/4396-485-0x00007FF8C0DA0000-0x00007FF8C0F13000-memory.dmp

Filesize
1.4MB

Download
memory/4396-494-0x00007FF8BEDD0000-0x00007FF8BEE88000-memory.dmp

Filesize
736KB

Download
memory/4396-493-0x00007FF8BEA50000-0x00007FF8BEDC5000-memory.dmp

Filesize
3.5MB

Download
memory/4396-492-0x00000143868B0000-0x0000014386C25000-memory.dmp

Filesize
3.5MB

Download
memory/4396-511-0x00007FF8BE900000-0x00007FF8BE922000-memory.dmp

Filesize
136KB

Download
memory/4396-510-0x00007FF8CBF00000-0x00007FF8CBF23000-memory.dmp

Filesize
140KB

Download
memory/4396-524-0x00007FF8C0D70000-0x00007FF8C0D9E000-memory.dmp

Filesize
184KB

Download
memory/4396-528-0x00007FF8BE8C0000-0x00007FF8BE8D1000-memory.dmp

Filesize
68KB

Download
memory/4396-527-0x00007FF8BEDD0000-0x00007FF8BEE88000-memory.dmp

Filesize
736KB

Download
memory/4396-530-0x00007FF8BE8A0000-0x00007FF8BE8BE000-memory.dmp

Filesize
120KB

Download
memory/4396-531-0x00007FF8BE130000-0x00007FF8BE825000-memory.dmp

Filesize
7.0MB

Download
memory/4396-529-0x00007FF8C49B0000-0x00007FF8C49C5000-memory.dmp

Filesize
84KB

Download
memory/4396-532-0x00007FF8BE0F0000-0x00007FF8BE128000-memory.dmp

Filesize
224KB

Download
memory/4396-526-0x00007FF8CDE30000-0x00007FF8CDE3A000-memory.dmp

Filesize
40KB

Download
memory/4396-525-0x00000143868B0000-0x0000014386C25000-memory.dmp

Filesize
3.5MB

Download
memory/4396-523-0x00007FF8BE830000-0x00007FF8BE87D000-memory.dmp

Filesize
308KB

Download
memory/4396-545-0x00007FF8BE930000-0x00007FF8BEA4C000-memory.dmp

Filesize
1.1MB

Download
memory/4396-522-0x00007FF8BEA50000-0x00007FF8BEDC5000-memory.dmp

Filesize
3.5MB

Download
memory/4396-521-0x00007FF8BE8E0000-0x00007FF8BE8F9000-memory.dmp

Filesize
100KB

Download
memory/4396-520-0x00007FF8C0DA0000-0x00007FF8C0F13000-memory.dmp

Filesize
1.4MB

Download
memory/4396-517-0x00007FF8BE880000-0x00007FF8BE897000-memory.dmp

Filesize
92KB

Download
memory/4396-547-0x00007FF8BE900000-0x00007FF8BE922000-memory.dmp

Filesize
136KB

Download
memory/4396-507-0x00007FF8BE930000-0x00007FF8BEA4C000-memory.dmp

Filesize
1.1MB

Download
memory/4396-505-0x00007FF8C0D10000-0x00007FF8C0D24000-memory.dmp

Filesize
80KB

Download
memory/4396-504-0x00007FF8CFB20000-0x00007FF8CFB39000-memory.dmp

Filesize
100KB

Download
memory/4396-502-0x00007FF8C0D30000-0x00007FF8C0D44000-memory.dmp

Filesize
80KB

Download
memory/4396-499-0x00007FF8C0D50000-0x00007FF8C0D62000-memory.dmp

Filesize
72KB

Download
memory/4396-496-0x00007FF8C49B0000-0x00007FF8C49C5000-memory.dmp

Filesize
84KB

Download
memory/4396-491-0x00007FF8C0D70000-0x00007FF8C0D9E000-memory.dmp

Filesize
184KB

Download
memory/4396-490-0x00007FF8BEE90000-0x00007FF8BF478000-memory.dmp

Filesize
5.9MB

Download
memory/4396-482-0x00007FF8CBF00000-0x00007FF8CBF23000-memory.dmp

Filesize
140KB

Download
memory/4396-481-0x00007FF8CDDD0000-0x00007FF8CDDE9000-memory.dmp

Filesize
100KB

Download
memory/4396-477-0x00007FF8CF460000-0x00007FF8CF46D000-memory.dmp

Filesize
52KB

Download
memory/4396-475-0x00007FF8CFB20000-0x00007FF8CFB39000-memory.dmp

Filesize
100KB

Download
memory/4396-454-0x00007FF8D0260000-0x00007FF8D026F000-memory.dmp

Filesize
60KB

Download
memory/4396-453-0x00007FF8CDE40000-0x00007FF8CDE64000-memory.dmp

Filesize
144KB

Download
memory/4396-561-0x00007FF8CDE30000-0x00007FF8CDE3A000-memory.dmp

Filesize
40KB

Download
memory/4396-560-0x00007FF8BE830000-0x00007FF8BE87D000-memory.dmp

Filesize
308KB

Download
memory/4396-592-0x00007FF8BE0F0000-0x00007FF8BE128000-memory.dmp

Filesize
224KB

Download
memory/4396-580-0x00007FF8C0D50000-0x00007FF8C0D62000-memory.dmp

Filesize
72KB

Download
memory/4396-579-0x00007FF8C49B0000-0x00007FF8C49C5000-memory.dmp

Filesize
84KB

Download
memory/4396-567-0x00007FF8BEE90000-0x00007FF8BF478000-memory.dmp

Filesize
5.9MB

Download
memory/4396-568-0x00007FF8CDE40000-0x00007FF8CDE64000-memory.dmp

Filesize
144KB

Download
memory/4396-591-0x00007FF8BE130000-0x00007FF8BE825000-memory.dmp

Filesize
7.0MB

Download
memory/4396-636-0x00007FF8D3FE0000-0x00007FF8D3FED000-memory.dmp

Filesize
52KB

Download
memory/4396-694-0x00007FF8BE830000-0x00007FF8BE87D000-memory.dmp

Filesize
308KB

Download
memory/4396-700-0x00007FF8D3FE0000-0x00007FF8D3FED000-memory.dmp

Filesize
52KB

Download
memory/4396-674-0x00007FF8BEE90000-0x00007FF8BF478000-memory.dmp

Filesize
5.9MB

Download
memory/4396-722-0x00007FF8BEDD0000-0x00007FF8BEE88000-memory.dmp

Filesize
736KB

Download
memory/4396-712-0x00007FF8BEE90000-0x00007FF8BF478000-memory.dmp

Filesize
5.9MB

Download
memory/4396-721-0x00007FF8C0D70000-0x00007FF8C0D9E000-memory.dmp

Filesize
184KB

Download
memory/4396-675-0x00007FF8CDE40000-0x00007FF8CDE64000-memory.dmp

Filesize
144KB

Download
memory/4396-686-0x00007FF8C49B0000-0x00007FF8C49C5000-memory.dmp

Filesize
84KB

Download
memory/4396-682-0x00007FF8C0DA0000-0x00007FF8C0F13000-memory.dmp

Filesize
1.4MB

Download
memory/4396-691-0x00007FF8BE900000-0x00007FF8BE922000-memory.dmp

Filesize
136KB

Download
memory/4396-692-0x00007FF8BE880000-0x00007FF8BE897000-memory.dmp

Filesize
92KB

Download
memory/4396-693-0x00007FF8BE8E0000-0x00007FF8BE8F9000-memory.dmp

Filesize
100KB

Download
memory/4560-789-0x00007FF8BD5E0000-0x00007FF8BDBC8000-memory.dmp

Filesize
5.9MB

Download
memory/4560-790-0x00007FF8D5920000-0x00007FF8D5944000-memory.dmp

Filesize
144KB

Download
memory/4560-791-0x00007FF8D5910000-0x00007FF8D591F000-memory.dmp

Filesize
60KB

Download
memory/4560-793-0x00007FF8D58E0000-0x00007FF8D58ED000-memory.dmp

Filesize
52KB

Download
memory/4560-792-0x00007FF8D58F0000-0x00007FF8D5909000-memory.dmp

Filesize
100KB

Download
memory/4560-794-0x00007FF8D58C0000-0x00007FF8D58D9000-memory.dmp

Filesize
100KB

Download
memory/4560-795-0x00007FF8D5890000-0x00007FF8D58BD000-memory.dmp

Filesize
180KB

Download
memory/4560-796-0x00007FF8D5860000-0x00007FF8D5883000-memory.dmp

Filesize
140KB

Download
memory/4560-797-0x00007FF8CF610000-0x00007FF8CF783000-memory.dmp

Filesize
1.4MB

Download
memory/4560-798-0x00007FF8BD5E0000-0x00007FF8BDBC8000-memory.dmp

Filesize
5.9MB

Download
memory/4560-801-0x00007FF8D5920000-0x00007FF8D5944000-memory.dmp

Filesize
144KB

Download
memory/4560-802-0x00007FF8BD260000-0x00007FF8BD5D5000-memory.dmp

Filesize
3.5MB

Download
memory/4560-800-0x00007FF8CFFC0000-0x00007FF8D0078000-memory.dmp

Filesize
736KB

Download
memory/4560-799-0x00007FF8D5830000-0x00007FF8D585E000-memory.dmp

Filesize
184KB

Download
memory/4560-803-0x000002157B370000-0x000002157B6E5000-memory.dmp

Filesize
3.5MB

Download
memory/4560-804-0x00007FF8D07F0000-0x00007FF8D0805000-memory.dmp

Filesize
84KB

Download
memory/4560-806-0x00007FF8D0370000-0x00007FF8D0382000-memory.dmp

Filesize
72KB

Download
memory/4560-805-0x00007FF8D58C0000-0x00007FF8D58D9000-memory.dmp

Filesize
100KB

Download
memory/4560-808-0x00007FF8D00D0000-0x00007FF8D00E4000-memory.dmp

Filesize
80KB

Download
memory/4560-807-0x00007FF8D5890000-0x00007FF8D58BD000-memory.dmp

Filesize
180KB

Download
memory/4560-810-0x00007FF8D00B0000-0x00007FF8D00C4000-memory.dmp

Filesize
80KB

Download
memory/4560-864-0x00007FF8BD5E0000-0x00007FF8BDBC8000-memory.dmp

Filesize
5.9MB

Download
memory/4560-809-0x00007FF8D5860000-0x00007FF8D5883000-memory.dmp

Filesize
140KB

Download
memory/4560-812-0x00007FF8CF4F0000-0x00007FF8CF60C000-memory.dmp

Filesize
1.1MB

Download
memory/4560-811-0x00007FF8CF610000-0x00007FF8CF783000-memory.dmp

Filesize
1.4MB

Download
memory/4560-814-0x00007FF8CFFC0000-0x00007FF8D0078000-memory.dmp

Filesize
736KB

Download
memory/4560-815-0x00007FF8CFF90000-0x00007FF8CFFB2000-memory.dmp

Filesize
136KB

Download
memory/4560-813-0x00007FF8D5830000-0x00007FF8D585E000-memory.dmp

Filesize
184KB

Download
memory/4560-816-0x00007FF8CFE80000-0x00007FF8CFE97000-memory.dmp

Filesize
92KB

Download
memory/4560-817-0x00007FF8BD260000-0x00007FF8BD5D5000-memory.dmp

Filesize
3.5MB

Download
memory/4560-819-0x00007FF8CFF50000-0x00007FF8CFF61000-memory.dmp

Filesize
68KB

Download
memory/4560-820-0x00007FF8CFE30000-0x00007FF8CFE7D000-memory.dmp

Filesize
308KB

Download
memory/4560-818-0x00007FF8CFF70000-0x00007FF8CFF89000-memory.dmp

Filesize
100KB

Download
memory/4560-823-0x00007FF8D37B0000-0x00007FF8D37BA000-memory.dmp

Filesize
40KB

Download
memory/4560-822-0x00007FF8CFF30000-0x00007FF8CFF4E000-memory.dmp

Filesize
120KB

Download
memory/4560-821-0x000002157B370000-0x000002157B6E5000-memory.dmp

Filesize
3.5MB

Download
memory/4560-824-0x00007FF8D07F0000-0x00007FF8D0805000-memory.dmp

Filesize
84KB

Download
memory/4560-825-0x00007FF8BCB60000-0x00007FF8BD255000-memory.dmp

Filesize
7.0MB

Download
memory/4560-826-0x00007FF8D0370000-0x00007FF8D0382000-memory.dmp

Filesize
72KB

Download
memory/4560-827-0x00007FF8CFD40000-0x00007FF8CFD78000-memory.dmp

Filesize
224KB

Download
memory/4560-855-0x00007FF8D5920000-0x00007FF8D5944000-memory.dmp

Filesize
144KB

Download
memory/4560-854-0x00007FF8D58E0000-0x00007FF8D58ED000-memory.dmp

Filesize
52KB

Download
memory/4560-861-0x00007FF8D5860000-0x00007FF8D5883000-memory.dmp

Filesize
140KB

Download
memory/4560-863-0x00007FF8D5830000-0x00007FF8D585E000-memory.dmp

Filesize
184KB

Download
memory/4560-860-0x00007FF8D5890000-0x00007FF8D58BD000-memory.dmp

Filesize
180KB

Download
memory/4560-859-0x00007FF8D58C0000-0x00007FF8D58D9000-memory.dmp

Filesize
100KB

Download
memory/4560-858-0x00007FF8CFE30000-0x00007FF8CFE7D000-memory.dmp

Filesize
308KB

Download
memory/4560-857-0x00007FF8D58F0000-0x00007FF8D5909000-memory.dmp

Filesize
100KB

Download
memory/4560-856-0x00007FF8D5910000-0x00007FF8D591F000-memory.dmp

Filesize
60KB

Download
memory/4560-862-0x00007FF8CF610000-0x00007FF8CF783000-memory.dmp

Filesize
1.4MB

Download
memory/4560-865-0x00007FF8CFFC0000-0x00007FF8D0078000-memory.dmp

Filesize
736KB

Download