rhadamanthys | hxxps://sourceforge[.]net/projects/arena-breakout-infinite-cheat/

Analysis

max time kernel
193s
max time network
197s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-08-2024 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sourceforge.net/projects/arena-breakout-infinite-cheat/

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://144.76.133.166:8034/5502b8a765a7d7349/2exkmrnd.gl5ss

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

RegAsm.exeRegAsm.exe

description	pid	Process	procid_target
PID 1748 created 2076	1748	RegAsm.exe	49
PID 3732 created 2076	3732	RegAsm.exe	49

Executes dropped EXE 5 IoCs

Processes:

Launcher.exeLauncher.exeLauncher.exeLauncher.exeLauncher.exe

pid	Process
5004	Launcher.exe
5584	Launcher.exe
2160	Launcher.exe
1556	Launcher.exe
4548	Launcher.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

Launcher.exeLauncher.exeLauncher.exeLauncher.exeLauncher.exe

description	pid	Process	procid_target
PID 5004 set thread context of 3128	5004	Launcher.exe	118
PID 5584 set thread context of 1748	5584	Launcher.exe	124
PID 2160 set thread context of 6136	2160	Launcher.exe	132
PID 1556 set thread context of 1496	1556	Launcher.exe	139
PID 4548 set thread context of 3732	4548	Launcher.exe	152

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2160	3128	WerFault.exe	118
2608	1748	WerFault.exe	124
5996	1748	WerFault.exe	124
6096	6136	WerFault.exe	132
2240	6136	WerFault.exe	132
3732	1496	WerFault.exe	139
4476	1496	WerFault.exe	139
3804	3732	WerFault.exe	152
5424	3732	WerFault.exe	152

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RegAsm.exeLauncher.exeopenwith.exeLauncher.exeopenwith.exeLauncher.exeRegAsm.exeLauncher.exeRegAsm.exeLauncher.exeRegAsm.exeRegAsm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exefirefox.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

Processes:

firefox.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description	ioc	Process
File created	C:\Users\Admin\Downloads\ARI.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

Processes:

NOTEPAD.EXE

pid	Process
4000	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

RegAsm.exeopenwith.exeRegAsm.exeopenwith.exe

pid	Process
1748	RegAsm.exe
1748	RegAsm.exe
5420	openwith.exe
5420	openwith.exe
5420	openwith.exe
5420	openwith.exe
3732	RegAsm.exe
3732	RegAsm.exe
2744	openwith.exe
2744	openwith.exe
2744	openwith.exe
2744	openwith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid	Process
6124	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

firefox.exe7zG.exe

description	pid	Process
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeRestorePrivilege	2676	7zG.exe
Token: 35	2676	7zG.exe
Token: SeSecurityPrivilege	2676	7zG.exe
Token: SeSecurityPrivilege	2676	7zG.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe
Token: SeDebugPrivilege	4596	firefox.exe

Suspicious use of FindShellTrayWindow 22 IoCs

Processes:

firefox.exe7zG.exe

pid	Process
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
2676	7zG.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

firefox.exeOpenWith.exe

pid	Process
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
4596	firefox.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe
6124	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	Process	procid_target
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 1792 wrote to memory of 4596	1792	firefox.exe	80
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2264	4596	firefox.exe	81
PID 4596 wrote to memory of 2088	4596	firefox.exe	82
PID 4596 wrote to memory of 2088	4596	firefox.exe	82
PID 4596 wrote to memory of 2088	4596	firefox.exe	82
PID 4596 wrote to memory of 2088	4596	firefox.exe	82
PID 4596 wrote to memory of 2088	4596	firefox.exe	82
PID 4596 wrote to memory of 2088	4596	firefox.exe	82
PID 4596 wrote to memory of 2088	4596	firefox.exe	82
PID 4596 wrote to memory of 2088	4596	firefox.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2076
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5420
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://sourceforge.net/projects/arena-breakout-infinite-cheat/"
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://sourceforge.net/projects/arena-breakout-infinite-cheat/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d238e493-1cde-4811-964b-65086f585b63} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" gpu
    3⤵
    PID:2264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e99d6fd9-65f2-4753-b523-c730380a8e05} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" socket
    3⤵
    PID:2088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3000 -childID 1 -isForBrowser -prefsHandle 3060 -prefMapHandle 3052 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce37fca2-7e96-41d7-8fa4-cf9c3832cb69} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:3032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -childID 2 -isForBrowser -prefsHandle 3868 -prefMapHandle 3864 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a344699-8fca-4e67-996c-9617a5b7d4cc} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4780 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4748 -prefMapHandle 4744 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04e0da25-6cfe-49a7-a8d1-0307448f535a} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" utility
    3⤵
    - Checks processor information in registry
    PID:1108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 3 -isForBrowser -prefsHandle 5452 -prefMapHandle 5524 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7c86ee0-6426-40a9-b0ea-18ae24879546} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:2812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5732 -childID 4 -isForBrowser -prefsHandle 5724 -prefMapHandle 5720 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {231d4aac-3cd6-44c6-bb96-c96f6e86acb0} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:1724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5864 -childID 5 -isForBrowser -prefsHandle 5872 -prefMapHandle 5876 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a84a4bb-4a39-4d35-b848-e63ac83104de} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:4008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 6 -isForBrowser -prefsHandle 6064 -prefMapHandle 6068 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69f9f24f-b5aa-4431-9713-53d7f0240fec} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:1656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5756 -childID 7 -isForBrowser -prefsHandle 6428 -prefMapHandle 5728 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5cbca7a-9afd-474c-b223-8bce95479227} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6420 -childID 8 -isForBrowser -prefsHandle 6432 -prefMapHandle 6436 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b8d6ef1-e955-42a3-95fe-68c9daae191d} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6232 -childID 9 -isForBrowser -prefsHandle 6164 -prefMapHandle 6152 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff417c0c-e2de-41c2-bd28-51d0a9cc193c} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6460 -childID 10 -isForBrowser -prefsHandle 5640 -prefMapHandle 5476 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3eac8e3c-6699-4edc-a558-af2ba3d37ba6} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:4460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6636 -childID 11 -isForBrowser -prefsHandle 6716 -prefMapHandle 6712 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e72d4b4-fa69-4143-98e8-4211aa17bd94} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6696 -childID 12 -isForBrowser -prefsHandle 6928 -prefMapHandle 6932 -prefsLen 27079 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3782f50d-9e0c-402f-a96c-9281b4016335} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -parentBuildID 20240401114208 -prefsHandle 3708 -prefMapHandle 5472 -prefsLen 29273 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e666f94c-ddb5-4d65-aa67-c37dbe904049} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" rdd
    3⤵
    PID:5700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7124 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 6744 -prefMapHandle 4344 -prefsLen 29273 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6eec5017-0c77-4ae7-a4b0-cef82bf1366f} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" utility
    3⤵
    - Checks processor information in registry
    PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6536 -childID 13 -isForBrowser -prefsHandle 5816 -prefMapHandle 5556 -prefsLen 27956 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9c84f19-5aa0-42e0-ae0e-7bc49bb33ff6} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6776 -childID 14 -isForBrowser -prefsHandle 7380 -prefMapHandle 7384 -prefsLen 27956 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eac6b481-d003-446d-af3c-c318ee7fb580} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:5716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4468 -childID 15 -isForBrowser -prefsHandle 1560 -prefMapHandle 4500 -prefsLen 27956 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6379fa0e-360a-43cb-bfb3-11e7215c4523} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:3692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6492 -childID 16 -isForBrowser -prefsHandle 6060 -prefMapHandle 5872 -prefsLen 27956 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41c9e056-0c90-4c70-ada7-b4b0ece90ac4} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6928 -childID 17 -isForBrowser -prefsHandle 6140 -prefMapHandle 4180 -prefsLen 28200 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac8e54bf-6291-4699-9712-a66ab0b1418d} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:1956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5104 -childID 18 -isForBrowser -prefsHandle 5096 -prefMapHandle 5100 -prefsLen 28200 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {324124e3-3747-477f-b72b-cbd13396f24d} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5848 -childID 19 -isForBrowser -prefsHandle 5964 -prefMapHandle 5992 -prefsLen 28200 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbd7fcdd-6eef-4b76-86ac-2fba8313ad50} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5084 -childID 20 -isForBrowser -prefsHandle 5228 -prefMapHandle 6148 -prefsLen 28200 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b07485fe-e0e6-477a-99d8-a1d4249d22c7} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:3764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5220 -childID 21 -isForBrowser -prefsHandle 6768 -prefMapHandle 6240 -prefsLen 30866 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29f57d93-d1dd-49a5-9121-195618de566c} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:3752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7924 -childID 22 -isForBrowser -prefsHandle 4588 -prefMapHandle 5560 -prefsLen 28200 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90841bd0-0fa1-4987-88ac-51353a30eac5} 4596 "\\.\pipe\gecko-crash-server-pipe.4596" tab
    3⤵
    PID:3196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5232

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ARI\" -an -ai#7zMap11684:120:7zEvent596
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2676

C:\Users\Admin\Downloads\ARI\Launcher.exe
"C:\Users\Admin\Downloads\ARI\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 416
    3⤵
    - Program crash
    PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3128 -ip 3128
1⤵
PID:5432

C:\Users\Admin\Downloads\ARI\Launcher.exe
"C:\Users\Admin\Downloads\ARI\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 548
    3⤵
    - Program crash
    PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 556
    3⤵
    - Program crash
    PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1748 -ip 1748
1⤵
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1748 -ip 1748
1⤵
PID:4436

C:\Users\Admin\Downloads\ARI\Launcher.exe
"C:\Users\Admin\Downloads\ARI\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 492
    3⤵
    - Program crash
    PID:6096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 500
    3⤵
    - Program crash
    PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6136 -ip 6136
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 6136 -ip 6136
1⤵
PID:5660

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ARI\res_mods\1.25.0.0\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4000

C:\Users\Admin\Downloads\ARI\Launcher.exe
"C:\Users\Admin\Downloads\ARI\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 496
    3⤵
    - Program crash
    PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 504
    3⤵
    - Program crash
    PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1496 -ip 1496
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1496 -ip 1496
1⤵
PID:1708

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6124
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\ARI\updates\icudtl.dat"
  2⤵
  PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\ARI\updates\icudtl.dat
    3⤵
    - Checks processor information in registry
    PID:3976

C:\Users\Admin\Downloads\ARI\Launcher.exe
"C:\Users\Admin\Downloads\ARI\Launcher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 516
    3⤵
    - Program crash
    PID:3804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 500
    3⤵
    - Program crash
    PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3732 -ip 3732
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3732 -ip 3732
1⤵
PID:5204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Launcher.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\activity-stream.discovery_stream.json

Filesize
33KB

MD5
c649cb2ea7e5a05c154fe81fa9ba3464

SHA1
df5bc1e754f9c13105ecca11d8bb24e5d1fd6aef

SHA256
e13e4462241c745893a44eae528c1417ef3bfb5b72e18cdeedfe4cba11c64fef

SHA512
14aef5e027943cb767bac1f30deac61acdfce96375a72dbf20b4a4193bfed5cbde4f3ea5cdcaeecef83ab3f10af65f3f0d926d0a633a2ad10f5507a9f1e5b11d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\doomed\29380

Filesize
38KB

MD5
36f02f8740dbec90f84aca3cd71bb17e

SHA1
c9f42ff42cedd26571d3873a5caa97f681f399a8

SHA256
c62321001abb1e5ed9a0558f7a9292854da9329cd99cae8235d0657121011d39

SHA512
681176fbc170bb22ee8f49671af3a6f5a09458b71862b647a2db1b49dde1637e0eb2c5a57707d69f27f6f8684f6d30f3d3799e37954c03a4fc104cee0a970306

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\038A410674D0C64849F56A4AC754B272766E401B

Filesize
123KB

MD5
ef32cf50e80648a46eac949365e14c53

SHA1
1cbdfbae649319aa9d0c008abc246f527533dbdf

SHA256
6c110c4824bb025fb8b7f27747be060221b1d3c22d7661978ef6b2b8a22d119b

SHA512
652fe7bc4827f0050be7f91357e8a9c266bd83d15a79f0f2887f9d7f9d5e8a567b4ec1a7350c19bae30e8a634b29e2d67820ec60661652aeb5ea374a75a127e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\093E3FB32E361EA8626C7B47D40261B5A9995C7C

Filesize
38KB

MD5
37b964d9e1af23f9e86412ac5cadad63

SHA1
b4bb2764385d4227bb6eee902f0a9fa6b9102b4a

SHA256
ceebded08366d75d913d71d7b706a8571a7a639ac67f2e4dd8f4bed77dc03671

SHA512
f99b4c7b87969e0510a82aa092aba56ece2b76d66fd6ab359d269870e7d47a354f94d60cf0facb1eccbabeb3565840501b08bfa187a5cc64a924cbb6827f32bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\1BEE7F147AE1732F917A6978562396802672235E

Filesize
191KB

MD5
e8510fb1affd5ac45aab2623b358d985

SHA1
e6b46a6346a42c55acc2ed5aaf6cf1f912b3d24c

SHA256
bc00d02ba2b93a8c90c73f1c6eb81cb9e2136311ee248ae3707cb7f9ea828431

SHA512
0bd0b277ecf3f624452e5877740618e8d179efdb19c318980bf8f9f731d3d84cba46c3c09f2609410752ff787f38f1cd5c47052abedaab54142867d481d8420f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\2353AC3352031A0F9F54387C6EB891DCFCE875F3

Filesize
2.3MB

MD5
513446500fb01acc7755bc61762bed98

SHA1
430e62a7e0129b93ff7e6a833ab390e6ae0a34e1

SHA256
38dc318c50d8db2c7c809a58b4c0362f6d4c57c83944d8d64cf25268ed9e68a7

SHA512
4c8c08f878aeda8ebf9771da37931818b81eaad653c194529993f34592dd4264121451fe101fcbf88bcba035603ad0c824afbd30f324b95ad2cce6ba89c9d463

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\23FC29C8C4630BFE99D998A0CCFBD79EFAAC432F

Filesize
434KB

MD5
ddbfed9e915ee8731edc21f6408eb10c

SHA1
35e10c6c4c0a95f1ad4d6f73f352b9efe181908a

SHA256
ac75f0b85dc357b9f6d83cd575aed5187806afd92f73245bfd9a40769caba923

SHA512
c10537a52d1e8714cde276dd9c26f003b938416ccd7d3c4b921706836812acd5dfd43b1e059db11a58ab9910f80a0d7d8a13d7a4c3c161a631db3514b4b97b22

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\328A9EC370A044C24FA3EC409208C5BA84E799B4

Filesize
134KB

MD5
09aee032ceff93ac67a7a9c4894690ec

SHA1
7ce739f21862abae30bd73ceb49ccebace96fe06

SHA256
387b46551ce04641cfa428144ead7548a165da48d04bb43cecc3bf3632aecffa

SHA512
c261bd72eb79e625c264ec39fa6a4da60ae191b0318e66c2ff0cf71ca6c991e76f65329bfe4dc3ea3573aa90eeb32b1e313290a916a13725363b180b434beb9e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\3BB60A97031A94072CE1BA2F10A1BDDEBA091533

Filesize
208KB

MD5
8dc65f29d0dd4ff26d01a5ba88ffa976

SHA1
35c838efc4e8d016435efe7ca66fb49e501ddd5a

SHA256
08822a5a50f2156a5f1fc731f5482624b3f9cee63ba8302f5514fa40795aee13

SHA512
e2dfdfbe8429a9c4a64248c79a1003141b58f36edafaba933b81b0843f4b623f2687d5d67833ad9860b11360e019f793032195fa75fa8bbec2ef893228beda94

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\41AF63B6189AC1C8FE9ADB0B9E1D9BCABCF3CF61

Filesize
104KB

MD5
d9596853da97b2389df98a264fc07fa6

SHA1
cc8d7f423bddf4972c6b8df75764c44b45b94d55

SHA256
eeb19bf445984b8d87d2307fac34062405a922ae657b6aad7dc8dc4229481eef

SHA512
a694cc99ddbbcd210c91bd2f50eef9490f7a5e15cf39f3b715b719f5a357bde41d36ea6211a93f00a1304e1643b66a5700d8b2676675e10a33b60574bdb3709e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\42A78275517D6CB0E30FAF0855FB773571E20C99

Filesize
534KB

MD5
5ce05b6835ff6372c757ada9aee6b76a

SHA1
ca32d3eeefb9c2a37d74739b5ed19d8a7e3e68b0

SHA256
58b3ee8e65a39ad4337150f30fa1942c5606dc1e632648be8386b9a664370f8d

SHA512
74ab2b9f94ff46be718bb9c6ae45b84d99deacab9ae220bf007da8e10ca0a1f6158c885ca4166b6709de9c3fc16a1f1e3c75dabbe6a4f47035705ab3a583fe54

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\43E11BF59ED02AE61D930765B86E3D6A6EDE489B

Filesize
1.0MB

MD5
4732c8d36928c5df87cf0f73196e3373

SHA1
dc11efdffbd5658b194164d2d68e836f664030ab

SHA256
a951f6f050f72bcf190dc9e07e28f299422d9a5d2bed00bbe2b735db622ddb77

SHA512
1227a580388b8903cb52a5d3ff4d7a0b32ec469465a15b63167b24597db3feae05e670740ffc2271bac3f456487a1e62335f61c99592ca031674ffd79f543add

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\5BF365CEBEFFFDC527CE3DA7772EB97DE9E84F53

Filesize
352KB

MD5
491c25f641778efe54b6bf6f1a7fbbf2

SHA1
1029fb679c9efa37cdff2e5e115e003a8e8a5ead

SHA256
07789d5928786f4656ad51d8995828dd569bf6b13e7dba1aa551bd76e68561b0

SHA512
b1103b41030f85231be48b3f3e5aa1e78875179c955be54ba267c6f9aef512543a70f2a0dab52c367a483a8dc0796ebc84a9a91c321fb20938f65ee5b0af745f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\5F92C7A74C62C7EC96F54316346A1BD79F8B4938

Filesize
38KB

MD5
22ded6eca9644bd6b88b860e43fb4b1e

SHA1
6b1c1d08800b8f3a450302fc2d443cfba3af78d8

SHA256
ba0f31ede3631f1faa793669f188bee324952f5b8348bddc306d1bf96e2ae661

SHA512
a889b8156c1cbaf9e67408bc5ade6c58b0c7c1fdeb770d08209cb08b6cf768f47ecd563dd717abd1c8e95d5f4fd70bae6641ab04ac29cc2ab68a0472ec4384e5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\61F6973DDB518BEBC8E3B388282CBE7C87D36BE4

Filesize
151KB

MD5
d98aba866fbabca3300fc94bf9752a9f

SHA1
6dc353b96a816954e548b6b217cd42c2c62db244

SHA256
685d59a6dbcf7f97b11780d927ad2819f83b9a8cd6439646dd7eae99dd3f0781

SHA512
c73d93078d9a809cfffe702af97b45af6c560ad527cc5ee825621b658eb4da7f079f1962862f9aec348773e816b4ea3d27b7b5fef405a098f27aac0d17c77a0b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\6433AD51A2362B298B92DE304F9271C1B3F08F77

Filesize
347KB

MD5
f717f6f9004fc43f33a2d4f33cf35a6b

SHA1
66fa632588b8e30e6c59207c1de6a051a2f4d088

SHA256
ac4ca90dc6853c7dd1d5caaaf44bad070032df90c1b03b2fbb2934b98a5be90f

SHA512
85c701510d686b5f2bbac5e8e121f9ea1ba076afed8522aa0d6a903ad6e29845a8b94c6a83b8fac539a4a7d13c2c8eadab1c3fd041d5a6fca5e19597f154e07c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\86CF897A50A71306D88CD81047064EE55BF92E7E

Filesize
21KB

MD5
b59febbb3f36a6f8fce9916d88b4e0bf

SHA1
768f3029494e401cbd3974c3a3a360b643d78365

SHA256
6ca3f5d9afa03bd52696a966ec39c85404c36756992fcd92c44cd529883c5602

SHA512
1e546bce1a5291c164e06d0c4dfbe512f9248be3bee1625ec973841d693cc721067ac410d595d00a79c72d2c69f3b71957513b699b50a29a3866f8982c2d769b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\8799E3517B81D1563454D12B021F5D951FB2BB63

Filesize
923KB

MD5
f73f42840dc9e04c4692d2b9eea09696

SHA1
7bd587eb6e44f5c7d6cc22f91526d57a529a743f

SHA256
917a0b219ce6a3adc5d855c429d683cae7ab7598d44d5b7f1511a944c8b53068

SHA512
ff04fe53726e0e6bae1d14df19146faa426469fcb9d93221e3cd06e2e4a013097759d18977e5d0a33f155576ae67b8fb9aca6299dbbca09cf31c70e0055a1115

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\8C2444046127ED539A9DE177C65A7FD2BBA39C81

Filesize
255KB

MD5
87715fbc6e516eca59def53081a79589

SHA1
489151ea1b8e12443eae6829e78ee68878e61a57

SHA256
b917c5b73aa4217bf22e48b6435efcb94499745e452e2f640d35c36759fdea55

SHA512
0c7538edc3cb3424b34029999bf145562593e59f00d4b0f72cb6c2bb1548193f4f79fa4a439463af269850123b31e710f8e08fcb6ee444d0ce08b656e8b40c75

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\97DF3BE25308BDAD2E6121BBCD04BCA8356F2BBA

Filesize
138KB

MD5
ccec37ef86d066b7bbdf2fbf3459905a

SHA1
df8fba1e56c34730ae464819f5f8bc445d3be05c

SHA256
ccf839de572aba97bddf69c6d12d65c9e8d88f879961815d88d29f43d0b3afad

SHA512
443856b982cfb9a6bd1699de56f9394801fd560149f357e30054a4924e72ca6e66b2adb77ffa8b4197cd3d6f8d5b6b94bed7b8110924145028d8c2df3a16f537

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\98E7CB868A0E2CCBB49693CA594496B2A4BD01CC

Filesize
1.3MB

MD5
ba72dc0372ed909ba4cabcc6d1c29a0c

SHA1
5d9b29a7eb6a7e911c6a735418ab41edb06bbeec

SHA256
0aaff9040bf6c39f7574b1ab2a56be43fdceffcbcfa236b62e1850d4bb6457c3

SHA512
ce25a901fcbe3a4336efc65429577fc21038533bfa6d976c125bc676d4076b7eccb3e80dcaaa0cc67209cd5df18ff343ea6350f64cb27fe89051b9579d2f5ee2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\AD525AE91F8D63419653596829AB9B1342CB5750

Filesize
72KB

MD5
ec9a13d3b2a6e463f95daebe2a1c5bf3

SHA1
30ca4d40db9802b759f6a30dee29f85364255223

SHA256
7a3aa530b3e874b0ad3fd31a74227fe7fd7b23f44358955271b3beb9b3e510d7

SHA512
31f6efff153cda74ba442e4458f54db45cc39c69fe4665458ff643cc43148d69d0ea2c5656a739307fd1e538d55b313c7f5a9870899f0de5c5c11c388adc1586

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\B6CC53B0972D295D54F95FA82A5838EC5616B026

Filesize
325KB

MD5
6a7b45e2bcb218d5046af1e92a59561c

SHA1
fc881f3bfa2f1aebad7f32b228430b5bf2f20110

SHA256
c622a1368f07dc701d6067e953fd1801d72f756625b53756a3275ab4dd91d133

SHA512
388deca71dff62416bc910cd858dc7e0273d7e2455e6caf9259bd7689b5ff81dcb232a0d6e506e438e3788f5d05c5760c7b328c0bc8a70ff94dd0d9c207e432f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\C2B828735262275DCB5D70CABE4E9361323DFA08

Filesize
2.2MB

MD5
56d100c78e2b3879a5dec9867498dd03

SHA1
e7b0c719c14f17d3b67464b7374d43d44ca5ff6f

SHA256
ac4f9d1ef7a768c44922c690b15a620f2b019a3f147d22a0262eddac157a609a

SHA512
87de42a3cebe0fe154e307a1cb3776f4bc0d32ce5ff03cacea5cf248baf42ea3cd670de70d35e7153cbc7371ed1631a6457529bb3bdd8648e61ee3bde89f1214

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\DC5FD619D750A3A466B8D116AD3CC7E352AD9A37

Filesize
120KB

MD5
cf015a80b78c466aebcd13c73f49bcd9

SHA1
9e4787973852a45afa3e875e301b4ded7382094a

SHA256
8fc269d634e9a608a62ab4e2e7b59664e53300530a2d64d9209d7d4013b568ff

SHA512
baf3af00eac3f7f9814306e577a52937256eb85f02e748e838f0505b352be6727cf4da799f640afa8b8b9dd9b2b974fa846693f0c81e901d35468a4cb612072f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\E2195B15E085550C47C77CCD6B686DD370076298

Filesize
282KB

MD5
0750cffd6ce6867d5e1c7dc60e92392a

SHA1
e9c9437e27d11459fe7391fb0b430c8cb49e807f

SHA256
de79899a1a596c56e8a1a5cd3b25d7685a1d3451d5ed6712a88dc525982e3dc2

SHA512
a48f0228352ca9cbfe5c2cdf503480f1078c7874db8acd6c5cc89e852bd0b36669d2beb78c89aa49ef7a8766140554a287ff83af009960c3d144afd5da88d4df

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\E281C1634A84CEABC88CEEC5CF96118DE718FAE3

Filesize
75KB

MD5
5adfe3f92e5fcf24157a4d71cdce741e

SHA1
8aea165a30dc8cb90c05660392fbd11179c9866f

SHA256
fd5e45148a45b6adc7fbf62c2a523e4a442e682429f8cf269f235faefd9c24fc

SHA512
b33a5f031d601a17eec6bcef94af1eb3c9a7aeee922299193391b9eb8a180f911c51f6e7cc7e77352b1d0d056f6e054a71df1905e4b679d0f8b1174656e7384b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\EC7BE79C44DE54E321A7E926E3BF1D5DAC55532D

Filesize
484KB

MD5
4a0c28f7fcf9d8a0a66fdb04d5baba43

SHA1
fdf65bb43110f86cfe479228dd45909b84213c16

SHA256
fdfa64f462dfacc5a09f892cdad45dc27d3d919f7f4a4277bdc4c2052bb0956b

SHA512
cd4029d1d59e394178264e2a066d999f617829ffe0db30c79980496bb512beb1da2aa814743b426cd74cd03afa303bc975842ef818ef1b576c89fa2e3cecc470

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\F1024191799870B12785EC8CF95ED4019EE3FD36

Filesize
455KB

MD5
95058427388e84197ffcad83785e64e9

SHA1
cabce00e2037c4b34bd816d464111c5fb7f6f38f

SHA256
38a52713e8ae1d9d90cfb3960cbcbef1df3cbe36e408bface0089d078d8ad50d

SHA512
5c4121ab0b03d6be0cd2d02af35a7e359b392fc19a8ef6c4a49c4e2f93975386ebe590dea3888d4a801bdcab5a35b48073d9db953a9a8904aa396172d374b139

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\F4966DEF139DE049B25F08AEA5E56F77FFCB5351

Filesize
187KB

MD5
e13829d1f9965bd02137ee771974c04d

SHA1
763b33ce22971113eaddc8bc0c1a6a9098dead0a

SHA256
0c8d0714f955557ebc92c8ff97b375ea8ead1eac7d43eff903b7db05d390bba4

SHA512
0752bf89e98cbb8d17daeda60ce158face438bce15ab19acda15367139ffeb3d9220e94cff19677d09429633979da8cdceabe6f089eb7beedebbcad572c6af09

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yel8o60i.default-release\cache2\entries\FC95563BEE2B5E8CD608EB5A7E3CB629F4756121

Filesize
423KB

MD5
51407fc0d976e2ebd7eb66af6cf953c3

SHA1
51f1594ce969b1d22f4e06493a6901dc99e472bb

SHA256
4ceb167d3a923a60aa7c6d80b8fed085172e48707cbcd96e3451d2df4d1891ad

SHA512
dcb851debb8dd7441a5d547767a8f2229e82e01a87edb2d5ea9d7a1ddac138a1f3b17ee518bac683c582fc8a97c117d9686b2e2f51faa0718d0e7cf169f44fb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin

Filesize
8KB

MD5
ec58064df431a2ae07c9a713835c09ed

SHA1
64ca87f1e9e9654061939ebd803f38e774ae6ad8

SHA256
88a6c191038b55797157496d6af425d367e99c0e5e505139b9efa31b4e992376

SHA512
3edc1ecb00ffcd3b85c7a53ebb29ffd508f5c64c12321156ac49105bf71fced76f9a4df6c5222a3559f6acc7e4dd52e4d1770927a91db87832d269507af54822

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin

Filesize
12KB

MD5
32658cea5b1fb7bc6d136468836842a4

SHA1
90a51fca7048fd3f16e554342c750407527a4436

SHA256
eefccff363ecf0dddffaf29cb6ead7fc1c4f5ec31d809b81fdf6b1e1dacb0f09

SHA512
1a4a0a9b37c09338238a836ac3e66e09cc50f2b0c2cf213891e306c2203e7dec42686d8ece0640ec34f301280074283e2824a59133709e751303c8857ec373ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\AlternateServices.bin

Filesize
30KB

MD5
d447686b10ccba7ed6538c3f42878f0b

SHA1
0e7a3d55740c21438c29b0795aa6fb6567f07aca

SHA256
a1047f104c7fc26cda9c5e788b8984983d1d6a07bc5b2a9782df95aed7ca4a9a

SHA512
d4dffca2c95b7f460724fab3618ea567a53f48043c122b2dac7b4fba72ff8440c12e264fffe7994e83a7f2c277942f3d96cbbe7ff6472da3c1cdda277cee253b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
a3f9ffe960d0c2cc5d8a99668fd9416c

SHA1
e6430ca67769f0e9f1987fe8ac1d837c7cefd7c0

SHA256
db4a868b69bde64ead9f5bc0edd7f1724468f0f4402e35cd415c1dde1579ce8a

SHA512
abec362def9d5ae364423f5a15b23a6a4ff420cc3ee3aa29e61e86c6f38304aec4e8ef4e0e575f80e84d12152dd9de4bf38eb74c6d7c83b0ad68668aedb58d9a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
95228aa59b648fc30fd094ae8f9538d1

SHA1
5ac828c1297f2c6ecde4ab3e6773d1f5d47ef535

SHA256
d3b198c63931a9428708745b2ddf8477b2f1712c913851bc79dbb3f3629f1880

SHA512
86af73d6a2554fa1b667974467da651914d1273c46ada019ac028cac02b4f4b495c9ef8ff909606eacf8b2d762412259a674e9c4c54b6309b867346a777f15b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b9dd09b3943fcc2cd8eff59d29bdeeec

SHA1
faea132b0767931d5bcb2f613b4a90e778dbcb65

SHA256
593e17a1436a5395c8ee815f0f5c4209a3ac7d5463f0b05e08794c8d4d227d00

SHA512
248be487610af7fe36ddb0a641143e865dd0002cdef299903c304f759eca14d42ff85f49b4ae0cef1739c3c47087697a645775ab23b85d451b6d6d8f0a50a2ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
b4c12ccfb7343eb43771853e1f0310f6

SHA1
afe73ac0f28411c33a65d597ece3e0c0ddfaaf36

SHA256
34bab5ab66955d22f13b993ff6e91a234191151b6efba60c3edda4bb59a81bc7

SHA512
5b3f8b8a3e71cd1d12a3adfe59ec3fcb3d1790894568facf807bea4ee57f356f20cfc3b447836547366c9196d11a0f4feb00d18c089a8e7dd86eca168e02513d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\027916b2-4195-48b2-a81a-b33c459e33c1

Filesize
982B

MD5
dac25a98d046da8d0201e208d0d7da4b

SHA1
6f3e3e0092449a67e7c4ca894e29deb4b534d09f

SHA256
4c70ad25f6e8b3c7e167564ea7f2ea0ed04f103b49e1a6c5960d6e9aa0982f67

SHA512
fb2afbed9cfe945f8e2af610f160535a302b2d715341d24a338ec87c5e694b959ac85f01cfb6c8e535b019de0fc4b36f7f6624260e722a01884a7e71384ac8f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\387c75d8-1c23-4649-8d20-454df633b8b1

Filesize
671B

MD5
2a8769b507e18f7d3b6cbd231df4640c

SHA1
1ba6dcc060147f0d371a62df33e85cdd0f9558f8

SHA256
24f41d88410063931e920969fbc2cec4017ddb15900972923d90f44a08655970

SHA512
988d9c7d64d4bfde757652acafb1c092af8bfebde30e2c92a71ae2433d2776d0f60816994ea42ac95640a2a95b208e0d3b2e302402023332debca88bd329a08b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\datareporting\glean\pending_pings\5c30ba3a-8f01-45c0-876c-093f82abb217

Filesize
25KB

MD5
173eb83a847c930dfd63feabbe68f2d9

SHA1
36ef8898ab994c8f042997b14671b00870c191cd

SHA256
1e83b4ad9dc6e4ae72ca74cd98f23d23e6cef5dc8f79cbd692ef041998a4cecd

SHA512
5a2a6916a8c78d0f30585110f2c733a82679f9c13910346d65f0ce68c32ebbeb51b2c7bd636227bd667c749fb5821af4fc8ebc75ad8a341aee21c9ca0a8da946

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs-1.js

Filesize
11KB

MD5
b0b3abda63e974ed647847b58400373a

SHA1
5b6ff91a3682a8a632f9ede1b8a510a184d33400

SHA256
e1963865017812e684b74fcbf5e9c2ec2a4d508aa51cb0adfa8352de27b6ed95

SHA512
b4ad0b701cc85a465af136a73736a4198451af2f14fafc9c1c53e2259e6c45445add8a8e5cc85ad6d0b84d6be2bbea08f1aea3c5a8213dc9031801fa44f94efc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs.js

Filesize
11KB

MD5
f23c11bd58068bed7db5fbbe066b6d18

SHA1
29d0c9ec32af61e319e35e23286f8b4a18cb7c44

SHA256
b6710b99cc4294072aa61444bc3356f83a655e38b9a5ff0891f9d11c68e93b6d

SHA512
39d1a6d5d8ee995ef382126a059dfcf240f15b7bcf78a76380cd3d4a026694bc323534ef98cd93a9ad428d5fcc41c5b0210a26f32880dd48b0ade0f6d4fa331d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\prefs.js

Filesize
10KB

MD5
ae7f167ee733304e356817d5334687fe

SHA1
757ec2c1998d8e74b1e34204607930f574579355

SHA256
e2bfe832756cf33c75f4e7ecb14ebe42478ceb2c40ee038c6adfa41c5ed4a60e

SHA512
23ed14b47704fa4c69d5d70cae429847519d283febcd7c9cc02a29194655c43343279b72b9b9780aebd8a24683a339eeffa0d2429cbafeee05b4f32a95dd7e9e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4

Filesize
11KB

MD5
bb9d915333d131aadffd9590a474973d

SHA1
7e30a406e2ee9baa9f88a4e8c7031829ea3e1849

SHA256
585ea5d7f2ce74bee3b850609ae640de570ae64dcca1fe37d288b32bedc7ced8

SHA512
3b0c8ed56761042db3682c270579202b0a527257a3bf129b09582aea66d8e0f381cacf741270f161a26ae9a3e7a8464601e4fc997493397a696bf3b2424e87bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
cfc62e21bbe4f109d1e15fa1f803909b

SHA1
815134c788d2e79e7529e2d3baa058292a708854

SHA256
322658dc930c7c2e5533c4d739185cdce8b52a9d6853a13f2020d45defe7aaf8

SHA512
4a02560b690eb3cb8d0bd5d709dcc6bbb924f5a1e6f038fc00db7408a48673dfe4827804356dc4511eef9ba66f0bbdb4cbc84e1c6cc40c38bed00a5c55959870

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
3f2cd4a767bc60cb44e5cb4200e10d96

SHA1
9c1c9ecf17d94f2d1e905fe362bc0b56e5477dfe

SHA256
a67553bb97a2a9c776f63ed1106a3e2887a323a9608b31cf6771c7a82b7d8ce0

SHA512
ae8a4940a71aa0d4a710217e5caf1e4ce4698a4064a1e1936aaad6a161ec0f7d4aead1d41cc793c11a32c1d37def949a041acfc4e194a4408edd628cb871346a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4

Filesize
22KB

MD5
5fec90495c5129664d4d897bf3c5d10b

SHA1
c806fdca983b425e03a687f8b5800c851cb39cb7

SHA256
cdc7e51c5a516ed6fe77101f96c8e6a5ce593b251ca82bd8dc76b435fb32bf82

SHA512
3b0f51e824a74c44a2f7ee4ae99dbbe04d116db5b213f2394800d11942d3c2e19011e41aadbe1fb47462847ced54eb30a8d962f8dde0507878945ce6feed9b63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yel8o60i.default-release\sessionstore-backups\recovery.baklz4

Filesize
22KB

MD5
4090b673192b75288a642d9bdf1f3072

SHA1
92e34f4297bbc3df910b96c18ec9810c5eeaa1a3

SHA256
d61ec6052ef65046c6a290591c318c0478daa37730557bc9b6198629852511ff

SHA512
979bc700f50d82e4f00aaef52946a7b9b3aa02f935a569709333023150bedee24e4d08e6d630dd1492bd2961e0cc61f330bfe3f7d4264a8d63c14552b6a1e027

Download Submit
C:\Users\Admin\Downloads\ARI.EsI0j8wM.zip.part

Filesize
4.1MB

MD5
ac00177e07dc37d8968a380f44af33dc

SHA1
7845605d25d9d2e90d8ca7d9c7b93391fabc59f5

SHA256
f5efe9843622cd586fe5317900e45a3d3897ce07f1beac7ca52affb2003b0a35

SHA512
5a849e3714b4ed03c3358d0846402b23bee3be462fdef83f178557aa761ac893d0a464cf7c2fdb62d51a9ce963d68e0c5b2fa9756eee936b9b169259f33f3cb9

Download Submit
C:\Users\Admin\Downloads\ARI\Launcher.exe

Filesize
443KB

MD5
88a017fbd5f869931dc0f3c191df2a09

SHA1
d22a18df91cb243be073d804849ace8ad9b2137d

SHA256
c0303cba5ecaa807991a18ea133f740cedb9a9b186a54ec6542fef5cc14476fc

SHA512
41318ce13576491258cfae00f6dd2266d855e0a773b2db6479ac1df10e16d3d6a6b6c569eb86ceaee55cb95e741908ff9c62aa41f9bc0c97c0b4ae7f2b87e1c9

Download Submit
C:\Users\Admin\Downloads\ARI\res_mods\1.25.0.0\readme.txt

Filesize
53B

MD5
1a4884dcdb1a8908bee1099dc846f896

SHA1
ca6b6f8b0a5ee2116163c7c5026d65adebab61a6

SHA256
83ab826c036bb841639276fa0e2b2d7dd07165cd2f17a039d0b3d0118d5c3f19

SHA512
e8cde35ffd67c94386faedb5caa70a1d6c2e076138ffe5d0c418e60efd2cc8ca53d2ca3b9268897ab4afd2c0328aa7383ef99ee59145ddc72f20007095ef3fa2

Download Submit
C:\Users\Admin\Downloads\ARI\updates\icudtl.dat

Filesize
9.8MB

MD5
65c6337820fbe9bf2498a9395e3b20f2

SHA1
5cc62646e6c73b4be276d08719bc5e257af972bb

SHA256
33da1cdda18eaea52011d40ae9a610cac9f6466156e9803891ee77294607aee4

SHA512
4800f03577a46a98a4bd786dc37a380f4169540e243fdb7835e3146fba0d0e1d07a7e3ec8cd23566feb00d204d582d678698ae61db156339fe56229de0b267c9

Download Submit
memory/1496-1386-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1496-1384-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1496-1401-0x0000000003A30000-0x0000000003E30000-memory.dmp

Filesize
4.0MB

Download
memory/1748-1317-0x0000000076530000-0x0000000076782000-memory.dmp

Filesize
2.3MB

Download
memory/1748-1301-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1748-1313-0x0000000004090000-0x0000000004490000-memory.dmp

Filesize
4.0MB

Download
memory/1748-1314-0x0000000004090000-0x0000000004490000-memory.dmp

Filesize
4.0MB

Download
memory/1748-1315-0x00007FFE66660000-0x00007FFE66869000-memory.dmp

Filesize
2.0MB

Download
memory/1748-1299-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2744-1495-0x00007FFE66660000-0x00007FFE66869000-memory.dmp

Filesize
2.0MB

Download
memory/2744-1497-0x0000000076530000-0x0000000076782000-memory.dmp

Filesize
2.3MB

Download
memory/2744-1494-0x0000000002570000-0x0000000002970000-memory.dmp

Filesize
4.0MB

Download
memory/3128-1240-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3128-1239-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3128-1243-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3128-1241-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3732-1487-0x00007FFE66660000-0x00007FFE66869000-memory.dmp

Filesize
2.0MB

Download
memory/3732-1461-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3732-1459-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3732-1485-0x0000000003FB0000-0x00000000043B0000-memory.dmp

Filesize
4.0MB

Download
memory/3732-1491-0x0000000076530000-0x0000000076782000-memory.dmp

Filesize
2.3MB

Download
memory/5004-1236-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/5004-1237-0x00000000009E0000-0x0000000000A52000-memory.dmp

Filesize
456KB

Download
memory/5004-1245-0x0000000074710000-0x0000000074EC1000-memory.dmp

Filesize
7.7MB

Download
memory/5004-1254-0x0000000074710000-0x0000000074EC1000-memory.dmp

Filesize
7.7MB

Download
memory/5420-1323-0x0000000076530000-0x0000000076782000-memory.dmp

Filesize
2.3MB

Download
memory/5420-1321-0x00007FFE66660000-0x00007FFE66869000-memory.dmp

Filesize
2.0MB

Download
memory/5420-1320-0x0000000002180000-0x0000000002580000-memory.dmp

Filesize
4.0MB

Download
memory/5420-1318-0x00000000004D0000-0x00000000004D9000-memory.dmp

Filesize
36KB

Download
memory/6136-1343-0x0000000003B50000-0x0000000003F50000-memory.dmp

Filesize
4.0MB

Download
memory/6136-1327-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/6136-1329-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download