Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 21:12

General

  • Target

    256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe

  • Size

    89KB

  • MD5

    6cd6f581096153b6f9e38e75262e2681

  • SHA1

    a5384c118bb1ac6774694df86b53f7b09f10ce20

  • SHA256

    256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d

  • SHA512

    4a65b06be0ccc06ac6dcd2ae1beb24adda77e45e1ee9cdac9ba6fadfae4345597b2dfd0397b311521b01de52623eb714b6aaf54e38feb646459337a2e226c5ba

  • SSDEEP

    1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfcxOKeO+:Hq6+ouCpk2mpcWJ0r+QNTBfc4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe
    "C:\Users\Admin\AppData\Local\Temp\256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\84D0.tmp\84D1.tmp\84D2.bat C:\Users\Admin\AppData\Local\Temp\256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd"
        3⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1360
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd8c93cc40,0x7ffd8c93cc4c,0x7ffd8c93cc58
          4⤵
            PID:3064
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1916 /prefetch:2
            4⤵
              PID:1320
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2176 /prefetch:3
              4⤵
                PID:4184
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1380,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2568 /prefetch:8
                4⤵
                  PID:4624
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:1
                  4⤵
                    PID:6064
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3344 /prefetch:1
                    4⤵
                      PID:6084
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4576 /prefetch:1
                      4⤵
                        PID:5364
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4608,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3692 /prefetch:8
                        4⤵
                          PID:5368
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4416,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4748 /prefetch:8
                          4⤵
                          • Modifies registry class
                          PID:5396
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5192,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5208 /prefetch:8
                          4⤵
                            PID:5836
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5248,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5256 /prefetch:8
                            4⤵
                              PID:6176
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5440,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5272 /prefetch:8
                              4⤵
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:7032
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd"
                            3⤵
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:3080
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd8ca946f8,0x7ffd8ca94708,0x7ffd8ca94718
                              4⤵
                                PID:2536
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                                4⤵
                                  PID:1760
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3448
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
                                  4⤵
                                    PID:800
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
                                    4⤵
                                      PID:3572
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                                      4⤵
                                        PID:2544
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5224 /prefetch:2
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5420
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd"
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5016
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                        4⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:3200
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1920 -parentBuildID 20240401114208 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcaca231-5197-4ddf-b57d-3ec73d831101} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" gpu
                                          5⤵
                                            PID:3908
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da028b75-7f8f-42d4-8ce3-0f67c9c2b196} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" socket
                                            5⤵
                                              PID:3888
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3292 -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 2844 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f0da532-8b0b-43da-863d-a55a73463ab4} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                                              5⤵
                                                PID:5004
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3228 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f894053-81ae-4e38-913e-cfcffb3666d7} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                                                5⤵
                                                  PID:1728
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4428 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4424 -prefMapHandle 4420 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {245e8d4e-7b07-486a-aca9-5c9a8e911541} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" utility
                                                  5⤵
                                                  • Checks processor information in registry
                                                  PID:5872
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 5364 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21b17a70-a4d7-44eb-abf6-ce9c8ff5ea71} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                                                  5⤵
                                                    PID:6000
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d808883-728b-44be-9a01-45be639bc964} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                                                    5⤵
                                                      PID:6096
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 5 -isForBrowser -prefsHandle 5728 -prefMapHandle 5736 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e21e31f1-791f-4ad3-8c0c-84e04b38332e} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                                                      5⤵
                                                        PID:5888
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5916 -childID 6 -isForBrowser -prefsHandle 6104 -prefMapHandle 6100 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84f96005-6137-42fc-80ab-b87926698227} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab
                                                        5⤵
                                                          PID:6420
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:1864
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:4156
                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                      1⤵
                                                        PID:5684
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                        1⤵
                                                          PID:6340

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                          Filesize

                                                          649B

                                                          MD5

                                                          0f1462e53c2f6af521a1a108dce41b0f

                                                          SHA1

                                                          35719abda1cef1592079f123ee75e47d2f23a743

                                                          SHA256

                                                          26231b08dfd8a0306616afdee50aa5921d6135ad09aa59b858b5495ffef224f3

                                                          SHA512

                                                          f25ac0caf9ca73d06e1ce9902b4be5b9514dedcb253818cdfc862bf487d0feb410bfc40a97bdb17f3a6879bca7842a776a927ec567afb771ef1c277cf2d71711

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          384B

                                                          MD5

                                                          51e750cd9e2f03f7c6dccc4df51d9965

                                                          SHA1

                                                          73476e70b3ed25605534164e44b92a2cec9e5bfd

                                                          SHA256

                                                          9e1303a97a43f913da073469c32ef11de06a752520bc49a66499eb1111f3f2ac

                                                          SHA512

                                                          1c8563cf72ddf883dd15c8cca61549590841625088a3b46bf65de154f03c950065f59a0d25be5a55afdc8aa3c4e971fa259ed9c1a7543d178198c272ecffbcfd

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          4ebab98fa3d52b43aa620565904e8134

                                                          SHA1

                                                          9eaf93ba96297124ce042e51891dfee797aad820

                                                          SHA256

                                                          a454140b865530077ae6caaaa21044b1f81c1b5f17adad01d3b2a458135dae77

                                                          SHA512

                                                          71f707ad3e635c582d746e3cfb1703ef56d79dd9c0b0e99cd015b87bb651b4099001f3aac6f90aa12cba7bb542ca91f8d6303bdaa93a04c5d4763f7c0af73fb4

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          e97bd0290db7e803937b234fa8d82929

                                                          SHA1

                                                          3183e4a2634907d76163190bc55a466826276715

                                                          SHA256

                                                          bd3006a33b873efa47605fd385633d6eeac1fe7c7fb69b9c66c3c67dd62f80b9

                                                          SHA512

                                                          99bf5d1bee034db783ac313025ab0f014a073787087b28cc322fb8cd64567ff739a95a47815bc7fcdb0b13bfd8e784e14486c14a17f9ff25e11ef95dd33eb79f

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                          Filesize

                                                          2B

                                                          MD5

                                                          d751713988987e9331980363e24189ce

                                                          SHA1

                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                          SHA256

                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                          SHA512

                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                          Filesize

                                                          354B

                                                          MD5

                                                          818c2e46804f321695f204be64637721

                                                          SHA1

                                                          a8d6d9b36184ae6e8c359bfc2660882af2b2887d

                                                          SHA256

                                                          5e10eef5242c07b84b562983a0631535630caec3e48e40d10bf6ada961f7b3c3

                                                          SHA512

                                                          a1f9270cbf63097e7d044828da9713c147fd9589be32d90d9516e1cff3dd0232d51c719ae9cf9c7f79b71b63141ca37cce81c3ef229e9fcc7d1b9c7d78ddd5b4

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                          Filesize

                                                          356B

                                                          MD5

                                                          393d2620560c2ef0b07809247980bb70

                                                          SHA1

                                                          3375710b44aecda0a3a6ec3a3eea722fe91f3f96

                                                          SHA256

                                                          3245540f25439d08f95d9f0182c74414d76894e6a9be19397e59a2f74444326d

                                                          SHA512

                                                          dee87ed2cb4aa76399283cd9f0cdf9cb205689e22a84d6818509011bd12ab860f923380a1744d400c1c59a236f13ded915d4d1693c09024bfbe58351d8124500

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                          Filesize

                                                          356B

                                                          MD5

                                                          3a26e725d38a7260974a2dc26bcf28a4

                                                          SHA1

                                                          5abffeea0a20097a8829a9e8154c376ffe0d4ea5

                                                          SHA256

                                                          8a58611424f3c907bb814dfdd937c92f87448d4a95bfcf4d34451998b725ddd0

                                                          SHA512

                                                          e2a499021a86bd19cfa241e59355856651afc50c9e4b4d6d2b659ffe0c88495522d2dc2bc663750fd3e667a6898c3c6eefc84824d9380edbf870e8c06cb4260d

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          7d1046247df1f238903c200332a99795

                                                          SHA1

                                                          4da6c0050496b8c33c51b8c86b2634014e2a2d20

                                                          SHA256

                                                          6a5adc62c0ebe4caea7d25c97708e87fa969a0c8f8db3746a4859bc6e978a69b

                                                          SHA512

                                                          074d85bf4a3ed540dc87e01a25c22ff493cb9702c761bb927bef9abe77210dce82613b1735be023b9566dd5dea4372be346eb1aa610853d394a9a78fe227e472

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          b3b362b803feb292d9019281b4842b0d

                                                          SHA1

                                                          b775a3d32b7a8ebb1f67fede64be28ceb06ef0d1

                                                          SHA256

                                                          25f7f3fdf9d1586a6be5c9dfebbdf92bc8f46b85315406df60b0280df8835846

                                                          SHA512

                                                          653961cb19389d9fec0e29172728818d3a0d66ef3b1c8b56d2b329a288fa8915351f0bebf260b7c5fb12b60b266b243cc108e7a92a716561b791ecfa14f05f88

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          9047f911c906ab9d8ff92cb7265f805d

                                                          SHA1

                                                          7ce4d6b8d46a9f16acc336d65c689764997450b5

                                                          SHA256

                                                          2fcf0d53236f89fc9fd42eecbd96149755061a1b35b0547e6d390eb7b1c0b4a9

                                                          SHA512

                                                          dab7207cd342d4354c1e59248f5848d655c4306c64a9a4d6a5b805dedfcde158dc690363f6e1257dc1deb072c4fa583d7b4064b5e1652d8131ab427ee1bd2694

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          970db36d0c63f61fa84dd9886d4eea81

                                                          SHA1

                                                          3c8eb41cd63685fe0f5f02b37cbba880b6d8d7be

                                                          SHA256

                                                          95741c583761350f92aec37a70701b4a29d95303a6fdad4915aafc1c0e927b8f

                                                          SHA512

                                                          7bdaa6f0a43cad119a05d8ebd8c05f4d4b5c479e543870f1d1f2019d73cae6a239417e21e8af479db54effaed91912f5a18a413deddfab0adb016b739b23b39c

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          7e6d2220248285cccb08a88dfa6e5853

                                                          SHA1

                                                          6d09199f206e6d90da920f51dec7244f0a571b62

                                                          SHA256

                                                          84491372c02ca90e9a0ec3463e70b97ad85db23a933c1cb6af52fc9967670855

                                                          SHA512

                                                          578bf2fa0e1b17ad5b36112197d09fa77a929b3e379640c0a7dc17d021cdfd3704fb34e70fe8e7d525ffaeab22f886838266a12ed0ebe7ea57d66778b36eb33d

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          a7d7cb6500f56353e58ee592cd3307f8

                                                          SHA1

                                                          67a855c23a95aaf567d9d61a0835a799d00932fe

                                                          SHA256

                                                          6d9d5d4e538e2676dd01d45534ba13bafe2507ff2cc88e8872579840bc87577b

                                                          SHA512

                                                          c76ed8291cfbd5bd3af9d71d1cdac3d9ddb665b20370564f79e5ea46da1e8410607c2a19c6c2de1ed3d7982e5ca70fec071bab187646436328d1f65ec7dc8fe6

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          8dfc908efefb86034d48ed3be6338cd2

                                                          SHA1

                                                          ca8d45e0efdf996d1009692b80063ff263728d29

                                                          SHA256

                                                          de454657e5f2c35bbe0baa42b59f398b4a7dccace9221bcf4d11b74b33ff77f1

                                                          SHA512

                                                          fb8e5679ba83bdeee95d217e3e16a86b601962dc6cf077375267052ab52fb9aa06ff070738b77b6f6c2a96accab387ba0c49a07bb09c47f78e697c29f06ce370

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          0b190f638f8e8eefe6ac6d826e34f2a7

                                                          SHA1

                                                          cc0a697ae03d938df9179c9f4d14eeeba5db6e69

                                                          SHA256

                                                          edccbbda31a98e4b10e515e423fe2166156ba6fb8df09919b856b5920c760b14

                                                          SHA512

                                                          abe0dbc1b6f0909e012f9ad4df7873c8d0917ad6555f93ec9baf1bd7d25a21f7d068894863f09d961d41a8eb6c7e7bd03536323e3ecee5d837ad08e3a0e7cf20

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          f3ec23636ff4bf32c7d131a2749c0851

                                                          SHA1

                                                          5ddb3d98e6121771bdad3d5970f519dc6c54347d

                                                          SHA256

                                                          3b0ec592343bfcb4716a92645b99ecdfec701d99830d82ee5552571c31be04b6

                                                          SHA512

                                                          3bae05769438f83d78cee3cf8aa26bda88b20c32ab0d3811f41cc5cfddbf980bcc391bf720a5dbf91462da14dc67ae06088ddc06992dc3bcc17196f70e764d76

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          a91c6ea49d9bbf242ce4dd2e5ca3233e

                                                          SHA1

                                                          e6da531cfb734798f6968d9ad8df7d0020488386

                                                          SHA256

                                                          ce43758eb38ec74a30d1a9a875be2e5b013a5606cf77064a6e836ad3638cb083

                                                          SHA512

                                                          0194aab3d37bbbf992c7fb0a1470e0ee8c5fbfb64d73f69655b7f1899d9ad1fec7387f1ac2bf6a04aac3e10154a6108871bd668000ba3e8f197ab17b985efbb8

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                          Filesize

                                                          15KB

                                                          MD5

                                                          e6dda4a6c7183f6892bae40b6adef1d3

                                                          SHA1

                                                          88f6727e8e7e90710eebfb3c02cf49899e3eb594

                                                          SHA256

                                                          617b4d1f24f228a7dbfec454dde1afae790a61f433a8e0a0db36f8d969781e8e

                                                          SHA512

                                                          5f8a43a4f455b8a65156cb9a34f1f41509f496267e5643c81a1d358ddc3c8f80e994df90aa872e84c305243b3aa54abc592795637bec4c206e337f067ea067cc

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          199KB

                                                          MD5

                                                          989b533f9802f94a310f1c9144cafa9e

                                                          SHA1

                                                          93b99c78140e58d99c4f5265bcae5eafe6551efe

                                                          SHA256

                                                          f26cb13ce9fac64e12a8176595020581b430d13da24c31cb17d4632e29f6d5cf

                                                          SHA512

                                                          98cd5df56088f2204e1d5ad771a3f77b8d67bb9e6368cd6087daedc38868957c2ac19d3589ade3b431f2e32b970179b9952f62ddef4e19915f8af80abae91243

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          199KB

                                                          MD5

                                                          94ac06fca5ec68486e015ae868977fe7

                                                          SHA1

                                                          aa07c6b50a52341b6d490ee3e84120659f7794ce

                                                          SHA256

                                                          ebcf65ede211816385e32384ae4385ac741a1a9eb6e25dc785cd3025bda78975

                                                          SHA512

                                                          e50af5ba2a0938429e8cd958af943288e7826e335def6b5d01e8d726933271ff8b6440840eff901da4d2e1eddc2555ef7ef791c3a9addb381228e6888779a622

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          ecf7ca53c80b5245e35839009d12f866

                                                          SHA1

                                                          a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                          SHA256

                                                          882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                          SHA512

                                                          706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          152B

                                                          MD5

                                                          4dd2754d1bea40445984d65abee82b21

                                                          SHA1

                                                          4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                          SHA256

                                                          183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                          SHA512

                                                          92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          336B

                                                          MD5

                                                          424ddb7de714675208e204149dac9bba

                                                          SHA1

                                                          b6c720492d313fcfa1a8ced63fd0a6548f6c5ae0

                                                          SHA256

                                                          b67947ca316a6d351b0e9518788af93673011f0867b6fc10fdf0a63409fdf88c

                                                          SHA512

                                                          e4e1d1c1c7c449cd1423ba3f8e178d1fbb06a0204fa2364372806cfa513ecc08745a32ef1b4920d6eea0c98ca853664a3fb06172340e239af8f70702405e833e

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          a5e17c98d8dd52744f220d4a9504f822

                                                          SHA1

                                                          687119b73be12a57f2c0a6892b400c2cdec6f94e

                                                          SHA256

                                                          d17d447983b99c264cc79bf6f11b0ee301639bbf2e871b7ad3ad3a048b3e42ba

                                                          SHA512

                                                          4483dc7d358a1b499f3491ffd65d7587e0a769d0c2db65386e739daaa73eb486981eae21ca3f215bfc26de4de69027dbd0fdc932285db14906e32ec0ea35b20a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                          Filesize

                                                          1KB

                                                          MD5

                                                          b0e1c79b0bddeec55c544332c01abfaa

                                                          SHA1

                                                          e516c8e9430a48da1538448c664e405aec417c42

                                                          SHA256

                                                          14cbe19a1bec35907657294a37c40365f4899cbdf099781c89d64b5229813aa0

                                                          SHA512

                                                          661f15d7b6eba519dd4d9b8ec5090d25b5f769b46d1f53b4c8e497e923278843d25f4ba323397c6dea0f3edbb71f227382f3e074e0182a5afdce54d1ba62760c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          017c877a1bf2624820d0f911e11ac4f1

                                                          SHA1

                                                          03eaaf7264e3c15a7ccbf093e14d601bb5e69121

                                                          SHA256

                                                          328c63537337f3301a174fc9e498c7893bc111ca5ee6ef78b2e179f26c953de4

                                                          SHA512

                                                          1781c04b19038808b243207897c1516e9f98bfdaa80ab9bd2371dcb98222d2f416bb2001e81b777a0f0abb43212dda6ff24bf0f4108981c63ca4f42fdbcf10b9

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          71dfec119b6b5f7e5bb2df803b9182e8

                                                          SHA1

                                                          67c7e8ae91d89f48e3964487a6bc0e0009d39cac

                                                          SHA256

                                                          c97f791ca2735930666897ed6d7f98445a5d8029bb1a3e94297547b0c50f06ee

                                                          SHA512

                                                          e793c9424a154843eaf23dab5333f0c430acbcf999a3efd51f374822a1d0963e61684cc17fe00ea4d4cfdabcfc3c99134c6746b97f24bf84168614d229b6a438

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                          Filesize

                                                          203B

                                                          MD5

                                                          e07e620ae5bad77a9d9189dda36b69f4

                                                          SHA1

                                                          f8dd2cd5f9e424ae2fe43bb1db3ead7254d558c1

                                                          SHA256

                                                          1e1d259d29b2afd7414e256de281ca3896af98d0c7c22d970f5b1d50d2cde488

                                                          SHA512

                                                          67d4f3db268d1c6421ecb6080b9465b822a14b9e6402fad2f19c16259a0dd678628293b2b7b677e5dc82406d3ce622d02f039e24fb560b0a289de0f0c9b67371

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                          Filesize

                                                          201B

                                                          MD5

                                                          8d0edd5bdc036483287dd6b0d0593450

                                                          SHA1

                                                          528c8c04f4169d6bfd4eae7715bffb23383778da

                                                          SHA256

                                                          4d0ffb7520958be5402ce177ad887b92400c93ac930c1acfbbb231199adb553f

                                                          SHA512

                                                          d7363f01f3b0e5521de8416065d5a47994d93e7a92195e0c080d608dd7e2a49886f8de006e37084e1a9d90639322e750fc5e271f7f6e1c81942230e66255f33a

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58af36.TMP

                                                          Filesize

                                                          203B

                                                          MD5

                                                          4cd7f33f1cefa5c37e9d79f93cc43bc1

                                                          SHA1

                                                          91db1d3dbd8ceb763dc148a731e4b2d8d513e1ad

                                                          SHA256

                                                          08da2cf95af29f36abc874eda287764830b49bde496a7c0a3e860674190b1837

                                                          SHA512

                                                          739117378abde6b9874e0d3fc928dc12ea5ee894d698eea2e2d7437770210ec9762fa1addeae2d7ab90eaaa8b712f09cdc38bf443a8317231dbfbbe451f4b57b

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          973ce1503d10364c0fa3ca473a444751

                                                          SHA1

                                                          bde5be0fca7e5fb1b626563d35a3ab23fc187b55

                                                          SHA256

                                                          b161dab8ca3061166be2f7156f832e3bf8523f1b3f80038e04a49e4619e2a20f

                                                          SHA512

                                                          cf9f8b56c8d0a0b520a8902770d655418a62cbd92ff9592b62f3489bfbeed165da6d0022706db3c2cea82d1eb3895ec500a247825dd86ee917f7f87021f10db7

                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json

                                                          Filesize

                                                          26KB

                                                          MD5

                                                          5b72a0a4a6be3a4327aa3fab4d4d0470

                                                          SHA1

                                                          eca100cb149e3df27137f930b1ad24ba66ba5b2a

                                                          SHA256

                                                          198a247bc992204ac10ac05dfb27e2e1e57ca5585e2efe638d59fb6ad526bc3a

                                                          SHA512

                                                          587b3baf6f685507b69b1e14a9b186e90256f012c94513b03648bb8ffca3353e775547759b7674a1b5024dd2890f04f33fc37ee385e867ac2fc9087fe881de1b

                                                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

                                                          Filesize

                                                          13KB

                                                          MD5

                                                          bdb9029c64d762a979f161aaa851c2fc

                                                          SHA1

                                                          41aa08b4829284e892cd9aba4d18a5da9e26c89c

                                                          SHA256

                                                          7cdf98c6fd898ae233bf9869930d562db88129ed62ca988fa396e0950991607e

                                                          SHA512

                                                          53b9f57cd3a58b139ca941f4fec34eb3ab3f47750214b3b7095a3ef93705eb4a58368d6facc7da983b19488ef8d8d3b274bd74324a710663cf78fbfe9ac28924

                                                        • C:\Users\Admin\AppData\Local\Temp\84D0.tmp\84D1.tmp\84D2.bat

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          31c09b550c61042384ef240a1cd226df

                                                          SHA1

                                                          731fbe63179f646915f8fa37ca9f8c85fdb9b48a

                                                          SHA256

                                                          752a176e12900c9f3cf947bc36d506e360f86da00a2dbc1e5fa821f2584c75db

                                                          SHA512

                                                          8fcd654736e4b71765b5379c6e1699771e83c5c1df1b5e3fa7f74e4d3b5629ffa1f54aaedfdf9979416d3704bcfb38d73dba7c36c7b6f1ac9804737e7af698a6

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                          Filesize

                                                          479KB

                                                          MD5

                                                          09372174e83dbbf696ee732fd2e875bb

                                                          SHA1

                                                          ba360186ba650a769f9303f48b7200fb5eaccee1

                                                          SHA256

                                                          c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                          SHA512

                                                          b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                          Filesize

                                                          13.8MB

                                                          MD5

                                                          0a8747a2ac9ac08ae9508f36c6d75692

                                                          SHA1

                                                          b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                          SHA256

                                                          32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                          SHA512

                                                          59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

                                                          Filesize

                                                          7KB

                                                          MD5

                                                          cb9148ca4acbfa48de90ba686b19967d

                                                          SHA1

                                                          acb46c81229b62de18ffa4c41a22f468e95a3211

                                                          SHA256

                                                          bfa7b7974448e8b2c8416b7c75630f183a18f5b97056e09a940fb755fca9cfe7

                                                          SHA512

                                                          fc066bf6890c5a1468ab5602a93ab7f99a34d06ac9ceab44a4fc26b02fa8e5f503bb4788951491ab648ea38b6dfa0edfe8b0562ed4f5fbd0f4028da170c2edf8

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin

                                                          Filesize

                                                          8KB

                                                          MD5

                                                          3b2e0a981427b6158eda23edf53d38f6

                                                          SHA1

                                                          16559e6f52e6d8c2ac900cb1b9854ed9a53f2942

                                                          SHA256

                                                          bb328f86e3d8c3cba1d5705cd6403c232af8eb8f72c0c7d5dbf10734adf0fa07

                                                          SHA512

                                                          d99dd148b95324e528855b1d06f88fa8c1fb2e7e2a1ecb35b117bfd694bbae5811e2725e74673c05d660e55aa5c4cc7d3be3a587b5fe2ea6e52a5cbd8db26642

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                                                          Filesize

                                                          6KB

                                                          MD5

                                                          24c5261fa9ed0b06e7c889bf13cd6ee4

                                                          SHA1

                                                          f81d7271858fb3b90ac1969fb3e30e8cb0c28ae4

                                                          SHA256

                                                          ce99e87358f1f6b0633d993ffd1ad78a1181e310e83d47c3d8699e08ad92b019

                                                          SHA512

                                                          c519fa394c35bc2d79694c1039e4331650182bb25ce8b0a49fa6a2a43072ab31ab4c9531eaaa54e8793c8354b46b52c53994fa8ecd103704ba8ca83578fc0377

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          14512c6561eb7d1b57c6cb9a831cc89e

                                                          SHA1

                                                          619656229a34a6d3f3770a0f9d28f6ffea08726d

                                                          SHA256

                                                          8efc12ad7da1b908c13c1eb31672d64222a9a1125e89ce4004a3ed77a190cba7

                                                          SHA512

                                                          6fb533af45764fce1e0f8eb5da40681f5e5ea7c621e27fe01ffd322d9ff936f031683892ed50b28eddb58efe9a39ff2747063a145e445908bb7ab07959c0400d

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp

                                                          Filesize

                                                          15KB

                                                          MD5

                                                          ecf86d762d9aa90d0b8f65c27d2828da

                                                          SHA1

                                                          9bd639c8e6977db54f385205e66b65211f686de1

                                                          SHA256

                                                          8734148ce8e3c91fa60e636dba97201f33426dad59ec210eb43cca299d018964

                                                          SHA512

                                                          fe111b3295a8d10e8e7615826760492abd3d7ee1e25a4837a9fe484444e8d72b1e905a959c563db968c06768a65fdb0d323c4a6a01a6fcecb1a92d4b55c520ae

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\35817f6a-a4b0-4508-9b63-50108eee135e

                                                          Filesize

                                                          28KB

                                                          MD5

                                                          12cf1f8ebd1e64bfe67607d7052dc687

                                                          SHA1

                                                          1d563ddcebb34322002c861d94ada13fe73cbe7d

                                                          SHA256

                                                          bff218d9b965cf9a7b74df2595fc40a5ee07113323568c8fd18d55a7e2dfdfe9

                                                          SHA512

                                                          d96339ac72f90caeef2f508b3014000a7cacc2e9095010e2037a0b520d16067de001eedd46c7c1713ae4226b843f64a18702944b7549899d59d00de5cb3e243e

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\bac67e0a-91f4-4d90-9a5f-642e0faa6e48

                                                          Filesize

                                                          982B

                                                          MD5

                                                          bab9ed4f78d423df5ac55a17b1a0cf7e

                                                          SHA1

                                                          da5de8a4d87d32f655d97d467c2a24b11bc05556

                                                          SHA256

                                                          e56ebb818bc40c45588ba54ef42cbd9a213553d41dbe715321b3c5dccb7982c9

                                                          SHA512

                                                          2126c249f72620e6a724fcb3a07252b24daa9f62d769d536ae2d23c757725b4e84567cbcd720fe43e5ef1ebacf5880e5e284b0f8daefbbd8859366ceb9e71678

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\faa2ef2c-b7eb-4374-a230-90eacb8c332e

                                                          Filesize

                                                          671B

                                                          MD5

                                                          d9b7b626939125f06067e5ba21fc1ec2

                                                          SHA1

                                                          fdbca4beb56376f15c6b744108ac0a29f583ab42

                                                          SHA256

                                                          777cffee7e6ba657fc42e0774e04e13ebc7962f8a435c035d9825274cd968937

                                                          SHA512

                                                          15a9cb1f21ecba03d76a487d4dd3b21b07d7640a5e3f783d078596ceb5d73a255d3e31d490fbd0f8a00d214ce32e5a133492d72ecb24642a9e1fc5b743550fa1

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          842039753bf41fa5e11b3a1383061a87

                                                          SHA1

                                                          3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                          SHA256

                                                          d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                          SHA512

                                                          d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                          Filesize

                                                          116B

                                                          MD5

                                                          2a461e9eb87fd1955cea740a3444ee7a

                                                          SHA1

                                                          b10755914c713f5a4677494dbe8a686ed458c3c5

                                                          SHA256

                                                          4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                          SHA512

                                                          34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                          Filesize

                                                          372B

                                                          MD5

                                                          bf957ad58b55f64219ab3f793e374316

                                                          SHA1

                                                          a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                          SHA256

                                                          bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                          SHA512

                                                          79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                          Filesize

                                                          17.8MB

                                                          MD5

                                                          daf7ef3acccab478aaa7d6dc1c60f865

                                                          SHA1

                                                          f8246162b97ce4a945feced27b6ea114366ff2ad

                                                          SHA256

                                                          bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                          SHA512

                                                          5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs-1.js

                                                          Filesize

                                                          13KB

                                                          MD5

                                                          4c91dd79acd9d8857dd9c25ce230c831

                                                          SHA1

                                                          bda309aca409b1cf364d11e1784b7ecb74d77f5d

                                                          SHA256

                                                          6c0d7c6bdfea78facb42bd6412749ff521ed611fb9c2b9471f670f4b07abd714

                                                          SHA512

                                                          203c0b6bd452d56b45bf7c9872d1edcd6f54b7d36d5f28bf82eb052c7a7d9e0a8b245be8e8e388d0101042782a9fa3ec288a0ac189fabbbdffae4e1d8eaa83f5

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs-1.js

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          feef9d94cb1864ae8d5fa337a87bf7d6

                                                          SHA1

                                                          c51ed7007d32354f3f256f2b4dd4bbdadf502bb2

                                                          SHA256

                                                          23ccaa5179bed2ed8ea60cd801fe38f681238a40e8661df9c77020eaeb53705d

                                                          SHA512

                                                          f408c60c9a52eb51cb7a3e9599d1bd28dd880608790ba01abbc53afcf9147df90b6c7834551c578b6c834e24c5365cd6683a93c71d838f0ec9832e6989dd149e

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs-1.js

                                                          Filesize

                                                          16KB

                                                          MD5

                                                          a1da92a5f1c25e02e6c47cacfb6add72

                                                          SHA1

                                                          fe84b5d93f441eb1d4e4e1a945dcdc27f3d70632

                                                          SHA256

                                                          153b5bd1dab7671bd4ee466f9adbf8767c07ddb91124898443d0852903074e53

                                                          SHA512

                                                          cf05cd6fed7d2dcbbf7afd72b112092a6ef574afaed3a195dc1e940c581e11f3c3224d72a3032a84a0a0c0104d8afb72c046c612776055d4c6d360d6eb018fbe

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\prefs.js

                                                          Filesize

                                                          11KB

                                                          MD5

                                                          7761fbad24914d88ea2a6e242a486415

                                                          SHA1

                                                          9db879df19260444fc9224a818cfbdca9acfe1f8

                                                          SHA256

                                                          2c9f3cdd53a606162d8840ce718be4de7dabdb05e9ba3afad59c37f342089708

                                                          SHA512

                                                          78de368090241679293a671c4309a2d89bd73b3494e4c79baaccb8c06ae38df589b576cc6694487e40f44dfc33010f1d334dd30287fc0a0ccc68c8ee9af63fcd

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\sessionstore-backups\recovery.baklz4

                                                          Filesize

                                                          5KB

                                                          MD5

                                                          ea8cde4808f5f6040476503eb5f37804

                                                          SHA1

                                                          6005369190ff7716337b8b99db1f291de27dab89

                                                          SHA256

                                                          1366c0e85312388b51919f6757ee8c5f46e22cfa3ec3be7d1fe0a149a55fc5c8

                                                          SHA512

                                                          f396c8707dc0ce405564358187d52e6ee378ec23714aa3dd25921ab2b8cfac777884e4a311bf715239975a17b57747c85f0a41367dbd26065284a804e4491a18

                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                          Filesize

                                                          1.2MB

                                                          MD5

                                                          d2e39504e82b4e9f9aba2f063a329d3b

                                                          SHA1

                                                          58572dfacaf956baec282630590e9232bcca108c

                                                          SHA256

                                                          bde722db9f680709d1e0fba356d446a58a6133267d4f6ef33df3ee856250edc8

                                                          SHA512

                                                          035a64b82f0a9b3adf25247efe24b4a620bae05f5f2763fa060034d16f8361889411a2e353e68a275d5e42a93f50c5a85845bbbfe47d4c56ac88188241b789bc