Resubmissions
27-08-2024 20:46
240827-zkjdda1cph 1027-08-2024 20:43
240827-zhpglssell 1027-08-2024 20:42
240827-zg4vxasdrr 1027-08-2024 19:27
240827-x6kgfsxeqg 10Analysis
-
max time kernel
464s -
max time network
605s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-08-2024 19:27
Static task
static1
Behavioral task
behavioral1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10-20240404-en
General
-
Target
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
-
SSDEEP
98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation @[email protected] -
Drops startup file 2 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD8230.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD8237.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 56 IoCs
Processes:
taskdl.exe@[email protected]@[email protected]@[email protected]taskhsvc.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe@[email protected]taskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exe7z2408-x64.exetaskse.exe@[email protected]taskdl.exe湸歀軞嘂鲪銑栌佼匂胉嚻嬬濫牮侥夻.exe氌艀碼鶟退謟窢嗚戤麘巨蘝検飆龗孭.exetaskse.exe@[email protected]taskdl.exe腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe@[email protected]pid Process 1880 taskdl.exe 5112 @[email protected] 4404 @[email protected] 4384 @[email protected] 4536 taskhsvc.exe 4416 taskdl.exe 4676 taskse.exe 4564 @[email protected] 3528 taskdl.exe 1564 taskse.exe 1128 @[email protected] 5132 taskdl.exe 1844 taskse.exe 5704 @[email protected] 3592 taskse.exe 908 @[email protected] 2424 taskdl.exe 6076 taskse.exe 2060 @[email protected] 3204 taskdl.exe 5268 taskse.exe 5148 @[email protected] 3620 taskdl.exe 5484 taskse.exe 5548 @[email protected] 2608 taskdl.exe 2576 taskse.exe 2408 @[email protected] 900 taskdl.exe 4528 taskse.exe 4036 @[email protected] 6104 taskdl.exe 5988 taskse.exe 3132 @[email protected] 5260 taskdl.exe 5052 @[email protected] 64 taskse.exe 5860 @[email protected] 5080 taskdl.exe 1520 taskse.exe 4924 @[email protected] 2696 taskdl.exe 5788 taskse.exe 4452 @[email protected] 5876 taskdl.exe 64 7z2408-x64.exe 1460 taskse.exe 4412 @[email protected] 5080 taskdl.exe 3452 湸歀軞嘂鲪銑栌佼匂胉嚻嬬濫牮侥夻.exe 380 氌艀碼鶟退謟窢嗚戤麘巨蘝検飆龗孭.exe 4532 taskse.exe 5840 @[email protected] 3872 taskdl.exe 3120 腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe 2968 @[email protected] -
Loads dropped DLL 9 IoCs
Processes:
taskhsvc.exepid Process 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 3156 -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qyrzxkvzsxw219 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 535 raw.githubusercontent.com 536 raw.githubusercontent.com 539 raw.githubusercontent.com 532 raw.githubusercontent.com 533 raw.githubusercontent.com 534 raw.githubusercontent.com -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exedescription ioc Process File opened for modification \??\PhysicalDrive0 腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe@[email protected]description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Drops file in Program Files directory 64 IoCs
Processes:
7z2408-x64.exedescription ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2408-x64.exe -
Drops file in Windows directory 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc Process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
Processes:
firefox.exedescription ioc Process File created C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier firefox.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
@[email protected]@[email protected]@[email protected]7z2408-x64.exe@[email protected]@[email protected]cmd.exe@[email protected]cmd.exe@[email protected]@[email protected]reg.exe@[email protected]ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exetaskdl.execscript.exetaskse.exe@[email protected]@[email protected]@[email protected]@[email protected]attrib.exe@[email protected]icacls.execmd.exetaskhsvc.exe@[email protected]cmd.exe@[email protected]@[email protected]@[email protected]@[email protected]attrib.exevssadmin.exeWMIC.exe@[email protected]description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z2408-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskhsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid Process 3848 vssadmin.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe7z2408-x64.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2408-x64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2408-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9a3f6a59b7f8da01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 282df35eb7f8da01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2408-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6dc79259b7f8da01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 717b015fb7f8da01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2408-x64.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{C9CFC098-9B07-4365-B76A-B3CD393036B8} = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2408-x64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\NumberOfSubdom = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe -
Modifies registry key 1 TTPs 1 IoCs
-
NTFS ADS 2 IoCs
Processes:
firefox.exedescription ioc Process File created C:\Users\Admin\Downloads\Monoxide.zip:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
taskhsvc.exepid Process 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe 4536 taskhsvc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid Process 4384 @[email protected] -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
MicrosoftEdgeCP.exepid Process 1460 MicrosoftEdgeCP.exe 1460 MicrosoftEdgeCP.exe 1460 MicrosoftEdgeCP.exe 1460 MicrosoftEdgeCP.exe 1460 MicrosoftEdgeCP.exe 1460 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exetaskse.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exetaskse.exeMicrosoftEdge.exetaskse.exetaskse.exetaskse.exetaskse.exedescription pid Process Token: SeBackupPrivilege 3076 vssvc.exe Token: SeRestorePrivilege 3076 vssvc.exe Token: SeAuditPrivilege 3076 vssvc.exe Token: SeIncreaseQuotaPrivilege 3200 WMIC.exe Token: SeSecurityPrivilege 3200 WMIC.exe Token: SeTakeOwnershipPrivilege 3200 WMIC.exe Token: SeLoadDriverPrivilege 3200 WMIC.exe Token: SeSystemProfilePrivilege 3200 WMIC.exe Token: SeSystemtimePrivilege 3200 WMIC.exe Token: SeProfSingleProcessPrivilege 3200 WMIC.exe Token: SeIncBasePriorityPrivilege 3200 WMIC.exe Token: SeCreatePagefilePrivilege 3200 WMIC.exe Token: SeBackupPrivilege 3200 WMIC.exe Token: SeRestorePrivilege 3200 WMIC.exe Token: SeShutdownPrivilege 3200 WMIC.exe Token: SeDebugPrivilege 3200 WMIC.exe Token: SeSystemEnvironmentPrivilege 3200 WMIC.exe Token: SeRemoteShutdownPrivilege 3200 WMIC.exe Token: SeUndockPrivilege 3200 WMIC.exe Token: SeManageVolumePrivilege 3200 WMIC.exe Token: 33 3200 WMIC.exe Token: 34 3200 WMIC.exe Token: 35 3200 WMIC.exe Token: 36 3200 WMIC.exe Token: SeIncreaseQuotaPrivilege 3200 WMIC.exe Token: SeSecurityPrivilege 3200 WMIC.exe Token: SeTakeOwnershipPrivilege 3200 WMIC.exe Token: SeLoadDriverPrivilege 3200 WMIC.exe Token: SeSystemProfilePrivilege 3200 WMIC.exe Token: SeSystemtimePrivilege 3200 WMIC.exe Token: SeProfSingleProcessPrivilege 3200 WMIC.exe Token: SeIncBasePriorityPrivilege 3200 WMIC.exe Token: SeCreatePagefilePrivilege 3200 WMIC.exe Token: SeBackupPrivilege 3200 WMIC.exe Token: SeRestorePrivilege 3200 WMIC.exe Token: SeShutdownPrivilege 3200 WMIC.exe Token: SeDebugPrivilege 3200 WMIC.exe Token: SeSystemEnvironmentPrivilege 3200 WMIC.exe Token: SeRemoteShutdownPrivilege 3200 WMIC.exe Token: SeUndockPrivilege 3200 WMIC.exe Token: SeManageVolumePrivilege 3200 WMIC.exe Token: 33 3200 WMIC.exe Token: 34 3200 WMIC.exe Token: 35 3200 WMIC.exe Token: 36 3200 WMIC.exe Token: SeTcbPrivilege 4676 taskse.exe Token: SeTcbPrivilege 4676 taskse.exe Token: SeDebugPrivilege 4588 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4588 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4588 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4588 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3128 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 3128 MicrosoftEdgeCP.exe Token: SeTcbPrivilege 1564 taskse.exe Token: SeTcbPrivilege 1564 taskse.exe Token: SeDebugPrivilege 4088 MicrosoftEdge.exe Token: SeDebugPrivilege 4088 MicrosoftEdge.exe Token: SeTcbPrivilege 1844 taskse.exe Token: SeTcbPrivilege 1844 taskse.exe Token: SeTcbPrivilege 3592 taskse.exe Token: SeTcbPrivilege 3592 taskse.exe Token: SeTcbPrivilege 6076 taskse.exe Token: SeTcbPrivilege 6076 taskse.exe Token: SeTcbPrivilege 5268 taskse.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
@[email protected]firefox.exepid Process 4384 @[email protected] 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
firefox.exepid Process 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe -
Suspicious use of SetWindowsHookEx 52 IoCs
Processes:
@[email protected]@[email protected]@[email protected]@[email protected]MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe@[email protected]@[email protected]@[email protected]firefox.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]7z2408-x64.exe@[email protected]Monoxide x64.exe湸歀軞嘂鲪銑栌佼匂胉嚻嬬濫牮侥夻.exeMonoxide x64.exe氌艀碼鶟退謟窢嗚戤麘巨蘝検飆龗孭.exe@[email protected]Monoxide x64.exe腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe@[email protected]pid Process 5112 @[email protected] 5112 @[email protected] 4404 @[email protected] 4404 @[email protected] 4384 @[email protected] 4384 @[email protected] 4564 @[email protected] 4088 MicrosoftEdge.exe 1460 MicrosoftEdgeCP.exe 4588 MicrosoftEdgeCP.exe 1460 MicrosoftEdgeCP.exe 1128 @[email protected] 5704 @[email protected] 908 @[email protected] 5252 firefox.exe 2060 @[email protected] 5148 @[email protected] 5548 @[email protected] 2408 @[email protected] 4036 @[email protected] 3132 @[email protected] 5052 @[email protected] 5860 @[email protected] 4924 @[email protected] 4452 @[email protected] 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 64 7z2408-x64.exe 5252 firefox.exe 5252 firefox.exe 5252 firefox.exe 4412 @[email protected] 5260 Monoxide x64.exe 3452 湸歀軞嘂鲪銑栌佼匂胉嚻嬬濫牮侥夻.exe 5504 Monoxide x64.exe 380 氌艀碼鶟退謟窢嗚戤麘巨蘝検飆龗孭.exe 5840 @[email protected] 4920 Monoxide x64.exe 3120 腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe 3120 腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe 2968 @[email protected] 2968 @[email protected] -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.execmd.execmd.exe@[email protected]@[email protected]cmd.execmd.exeMicrosoftEdgeCP.exedescription pid Process procid_target PID 2584 wrote to memory of 3308 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 71 PID 2584 wrote to memory of 3308 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 71 PID 2584 wrote to memory of 3308 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 71 PID 2584 wrote to memory of 1000 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 72 PID 2584 wrote to memory of 1000 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 72 PID 2584 wrote to memory of 1000 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 72 PID 2584 wrote to memory of 1880 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 75 PID 2584 wrote to memory of 1880 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 75 PID 2584 wrote to memory of 1880 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 75 PID 2584 wrote to memory of 3856 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 76 PID 2584 wrote to memory of 3856 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 76 PID 2584 wrote to memory of 3856 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 76 PID 3856 wrote to memory of 1020 3856 cmd.exe 78 PID 3856 wrote to memory of 1020 3856 cmd.exe 78 PID 3856 wrote to memory of 1020 3856 cmd.exe 78 PID 2584 wrote to memory of 8 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 79 PID 2584 wrote to memory of 8 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 79 PID 2584 wrote to memory of 8 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 79 PID 2584 wrote to memory of 5112 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 83 PID 2584 wrote to memory of 5112 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 83 PID 2584 wrote to memory of 5112 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 83 PID 2584 wrote to memory of 1156 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 84 PID 2584 wrote to memory of 1156 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 84 PID 2584 wrote to memory of 1156 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 84 PID 1156 wrote to memory of 4404 1156 cmd.exe 86 PID 1156 wrote to memory of 4404 1156 cmd.exe 86 PID 1156 wrote to memory of 4404 1156 cmd.exe 86 PID 5112 wrote to memory of 4536 5112 @[email protected] 90 PID 5112 wrote to memory of 4536 5112 @[email protected] 90 PID 5112 wrote to memory of 4536 5112 @[email protected] 90 PID 4404 wrote to memory of 3640 4404 @[email protected] 92 PID 4404 wrote to memory of 3640 4404 @[email protected] 92 PID 4404 wrote to memory of 3640 4404 @[email protected] 92 PID 3640 wrote to memory of 3848 3640 cmd.exe 94 PID 3640 wrote to memory of 3848 3640 cmd.exe 94 PID 3640 wrote to memory of 3848 3640 cmd.exe 94 PID 3640 wrote to memory of 3200 3640 cmd.exe 96 PID 3640 wrote to memory of 3200 3640 cmd.exe 96 PID 3640 wrote to memory of 3200 3640 cmd.exe 96 PID 2584 wrote to memory of 4416 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 98 PID 2584 wrote to memory of 4416 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 98 PID 2584 wrote to memory of 4416 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 98 PID 2584 wrote to memory of 4676 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 99 PID 2584 wrote to memory of 4676 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 99 PID 2584 wrote to memory of 4676 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 99 PID 2584 wrote to memory of 4564 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 100 PID 2584 wrote to memory of 4564 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 100 PID 2584 wrote to memory of 4564 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 100 PID 2584 wrote to memory of 2148 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 101 PID 2584 wrote to memory of 2148 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 101 PID 2584 wrote to memory of 2148 2584 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe 101 PID 2148 wrote to memory of 1448 2148 cmd.exe 103 PID 2148 wrote to memory of 1448 2148 cmd.exe 103 PID 2148 wrote to memory of 1448 2148 cmd.exe 103 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 PID 1460 wrote to memory of 1156 1460 MicrosoftEdgeCP.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid Process 3308 attrib.exe 8 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3308
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 289311724786891.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- System Location Discovery: System Language Discovery
PID:1020
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @[email protected] vs2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:3848
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4676
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4564
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1448
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3528
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1128
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:5132
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5704
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2424
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6076
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3204
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5268
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5148
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:5484
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5548
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2408
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:900
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:4528
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:6104
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:5988
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3132
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:5260
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:64
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5860
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:5788
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4452
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:5876
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:4532
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5840
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3872
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:7388
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:7396
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:7528
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:6196
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:6588
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:5836
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:588
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:8012
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:9784
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:9792
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:10076
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:4452
-
-
C:\Users\Admin\Desktop\@[email protected]"C:\Users\Admin\Desktop\@[email protected]"1⤵
- Checks computer location settings
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4384
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4088
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4932
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4588
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1156
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:5228
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5252 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.0.463218242\1521895191" -parentBuildID 20221007134813 -prefsHandle 1800 -prefMapHandle 1764 -prefsLen 18084 -prefMapSize 231738 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbf97a95-1002-47f9-a6ae-a6be1342224b} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 1872 1f5da903258 socket3⤵PID:5928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.1.1247128477\877816703" -parentBuildID 20221007134813 -prefsHandle 2420 -prefMapHandle 1888 -prefsLen 19118 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bc63737-bf13-4760-9897-ac9a135a41bc} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 2264 1f5db60d958 gpu3⤵PID:5596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.2.1764423808\1438446304" -childID 1 -isForBrowser -prefsHandle 3356 -prefMapHandle 3352 -prefsLen 19793 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f82cc2c-a454-4653-b2d5-a2eaad70b297} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 3368 1f5de35e358 tab3⤵PID:5956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.3.688988972\635101420" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3600 -prefsLen 19980 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93ffb86e-df10-4563-a68f-8144e663ea44} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 3564 1f5da95f958 tab3⤵PID:6060
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.4.2146583788\190746601" -childID 3 -isForBrowser -prefsHandle 3576 -prefMapHandle 4032 -prefsLen 26247 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9018565-ac54-41dc-88e1-4fb0e57c22a4} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 3556 1f5dd82b858 tab3⤵PID:2200
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.5.565060287\297574830" -parentBuildID 20221007134813 -prefsHandle 4820 -prefMapHandle 4676 -prefsLen 27588 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e929adf9-b742-4bd3-be3b-dbe002405084} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 4776 1f5dc490158 rdd3⤵PID:1112
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.6.99064026\1580341365" -childID 4 -isForBrowser -prefsHandle 5196 -prefMapHandle 5184 -prefsLen 27712 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b18ae450-559b-479a-af5c-5f7b4e9c804e} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 5188 1f5cf567558 tab3⤵PID:520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.7.1996683221\1714606709" -childID 5 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 27712 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3eca05d3-aca2-4932-b0de-e7a85d9b6c18} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 5348 1f5e1ddf958 tab3⤵PID:2276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.8.293335341\1850286038" -childID 6 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27712 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f154cb41-6c09-484c-89df-33b26b7a5320} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 5520 1f5e1de0558 tab3⤵PID:5692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.9.1747158789\1224730040" -childID 7 -isForBrowser -prefsHandle 5960 -prefMapHandle 5944 -prefsLen 27712 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69721f08-19c4-4d54-9c48-150a54388104} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 5976 1f5e3654158 tab3⤵PID:1448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.10.568000694\2033620353" -childID 8 -isForBrowser -prefsHandle 5260 -prefMapHandle 5720 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d79b03b-175a-4a79-bdbb-3afeea353224} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 5272 1f5cf55cd58 tab3⤵PID:3076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.11.691945824\16764019" -childID 9 -isForBrowser -prefsHandle 5432 -prefMapHandle 5344 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96fe2a4e-b40d-4f3f-8496-5b3ffa5c662e} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 5820 1f5e3adae58 tab3⤵PID:4496
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.12.1757980847\968962916" -childID 10 -isForBrowser -prefsHandle 9904 -prefMapHandle 9908 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4320a78d-c6a5-4c36-884c-599545f75cae} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9916 1f5da745058 tab3⤵PID:3428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.13.614004508\829432564" -childID 11 -isForBrowser -prefsHandle 9764 -prefMapHandle 9760 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dd9fdc0-c7c5-434e-ba28-1eab13c939e8} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9772 1f5e2689b58 tab3⤵PID:5360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.14.957005994\762255830" -childID 12 -isForBrowser -prefsHandle 9208 -prefMapHandle 9204 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fe341df-1f61-4f45-bfed-d22e957f50c6} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9376 1f5e63c3658 tab3⤵PID:2460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.15.1937341475\268210409" -childID 13 -isForBrowser -prefsHandle 9576 -prefMapHandle 9892 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f11b8a79-3019-48f7-ac8a-61d87ad03de8} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9800 1f5e65f0858 tab3⤵PID:1660
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.16.119687865\26248590" -childID 14 -isForBrowser -prefsHandle 9184 -prefMapHandle 9188 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21f9f444-ad8e-41b1-9f5c-088d3a8ebe51} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9144 1f5e65ef658 tab3⤵PID:944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.17.841888824\1167439405" -childID 15 -isForBrowser -prefsHandle 8960 -prefMapHandle 10056 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87f9ff52-fa3f-4d75-9682-83f1a7076364} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9632 1f5e72abe58 tab3⤵PID:1952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.18.2016266706\1954307714" -childID 16 -isForBrowser -prefsHandle 10000 -prefMapHandle 8792 -prefsLen 28917 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d7fb766-35db-4969-86a9-593d61b11805} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 5000 1f5e7745858 tab3⤵PID:5672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.19.154504789\92179098" -childID 17 -isForBrowser -prefsHandle 9368 -prefMapHandle 9712 -prefsLen 29022 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d94191d0-c250-470f-9fd0-58260c69a9c9} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9912 1f5e3640558 tab3⤵PID:6052
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.20.1624914759\1427858513" -childID 18 -isForBrowser -prefsHandle 9256 -prefMapHandle 1488 -prefsLen 29022 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76436773-fb55-4edd-9f00-fb6285ddc845} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9580 1f5e3640858 tab3⤵PID:1900
-
-
C:\Users\Admin\Downloads\7z2408-x64.exe"C:\Users\Admin\Downloads\7z2408-x64.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:64
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.21.1205634890\1066737452" -childID 19 -isForBrowser -prefsHandle 8664 -prefMapHandle 8800 -prefsLen 29022 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {230d359d-c628-4a23-a076-4dde4611caff} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 8716 1f5e38e9558 tab3⤵PID:4008
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.22.401111958\192483502" -childID 20 -isForBrowser -prefsHandle 8252 -prefMapHandle 8244 -prefsLen 29022 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae9e8fdb-829d-4dc7-92f3-c0221326e43f} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 8196 1f5e7295458 tab3⤵PID:3780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.23.1036090735\2107626760" -childID 21 -isForBrowser -prefsHandle 7900 -prefMapHandle 7896 -prefsLen 29022 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae8338e7-4100-4a5e-83e1-a8feacd498c1} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 7908 1f5e73cfd58 tab3⤵PID:644
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5252.24.526017255\1284823132" -childID 22 -isForBrowser -prefsHandle 9772 -prefMapHandle 9572 -prefsLen 29022 -prefMapSize 231738 -jsInitHandle 1280 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2a9cb70-c40e-48ef-8fe7-27df08055392} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" 9124 1f5cf56d658 tab3⤵PID:6064
-
-
-
C:\Windows\system32\NOTEPAD.EXEPID:2328
-
"C:\@[email protected]"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5052
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1372
-
C:\Users\Admin\Desktop\Monoxide x64.exe"C:\Users\Admin\Desktop\Monoxide x64.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\湸歀軞嘂鲪銑栌佼匂胉嚻嬬濫牮侥夻.exe"C:\Users\Admin\AppData\Local\Temp\湸歀軞嘂鲪銑栌佼匂胉嚻嬬濫牮侥夻.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3452
-
-
C:\Users\Admin\Desktop\Monoxide x64.exe"C:\Users\Admin\Desktop\Monoxide x64.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\氌艀碼鶟退謟窢嗚戤麘巨蘝検飆龗孭.exe"C:\Users\Admin\AppData\Local\Temp\氌艀碼鶟退謟窢嗚戤麘巨蘝検飆龗孭.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:380
-
-
C:\Users\Admin\Desktop\Monoxide x64.exe"C:\Users\Admin\Desktop\Monoxide x64.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe"C:\Users\Admin\AppData\Local\Temp\腛弈绗浍裴縙闦哆納俩熣亯牒岁睍粔.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:3120 -
"C:\@[email protected]"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\eo.txt3⤵PID:6224
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\pt-br.txt3⤵PID:6244
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\yo.txt3⤵PID:6272
-
-
C:\Program Files\Common Files\microsoft shared\ink\mip.exe"C:\Program Files\Common Files\microsoft shared\ink\mip.exe"3⤵PID:6676
-
-
C:\Program Files\Java\jdk-1.8\bin\javac.exe"C:\Program Files\Java\jdk-1.8\bin\javac.exe"3⤵PID:6584
-
-
C:\Program Files\Java\jdk-1.8\bin\javadoc.exe"C:\Program Files\Java\jdk-1.8\bin\javadoc.exe"3⤵PID:5132
-
-
C:\Program Files\Java\jdk-1.8\bin\jdeps.exe"C:\Program Files\Java\jdk-1.8\bin\jdeps.exe"3⤵PID:7068
-
-
C:\Program Files\Java\jdk-1.8\bin\wsgen.exe"C:\Program Files\Java\jdk-1.8\bin\wsgen.exe"3⤵PID:6768
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Java\jre-1.8\README.txt3⤵PID:7772
-
-
C:\Program Files\Microsoft Office\root\Integration\Integrator.exe"C:\Program Files\Microsoft Office\root\Integration\Integrator.exe"3⤵PID:7900
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt3⤵PID:7428
-
-
C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE"C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE"3⤵PID:7716
-
-
C:\Program Files\Microsoft Office\root\Office16\msoia.exe"C:\Program Files\Microsoft Office\root\Office16\msoia.exe"3⤵PID:3528
-
-
C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE"C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE"3⤵PID:7076
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PROFILE.INF3⤵PID:7124
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.INF3⤵PID:7700
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css3⤵PID:8188
-
-
C:\Program Files\Windows Media Player\setup_wm.exe"C:\Program Files\Windows Media Player\setup_wm.exe"3⤵PID:8920
-
-
C:\Program Files\Windows NT\Accessories\wordpad.exe"C:\Program Files\Windows NT\Accessories\wordpad.exe"3⤵PID:9084
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Resources\TopicPage\core_rtl.css3⤵PID:5788
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCAT C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat3⤵PID:8408
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\styles\WefGalleryOnenote.css3⤵PID:8528
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1"3⤵PID:1072
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\ContainExactly.ps1"3⤵PID:8604
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\GlobalMock-A.Tests.ps1"3⤵PID:7208
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeGreaterThan.snippets.ps1xml3⤵PID:2676
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\fr-FR\PSGet.Resource.psd1"3⤵PID:8648
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe"3⤵PID:8904
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js"3⤵PID:6532
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\ui-strings.js"3⤵PID:9052
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\ui-strings.js"3⤵PID:8812
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js"3⤵PID:8136
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js"3⤵PID:8824
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\sv-se\ui-strings.js"3⤵PID:8440
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js"3⤵PID:7048
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main.css3⤵PID:9008
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pl-pl\ui-strings.js"3⤵PID:8992
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js"3⤵PID:5412
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\hu-hu\ui-strings.js"3⤵PID:9032
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ui-strings.js"3⤵PID:8724
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-selector.js"3⤵PID:8524
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\ui-strings.js"3⤵PID:7388
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\ui-strings.js"3⤵PID:9072
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-il\ui-strings.js"3⤵PID:9176
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\ui-strings.js"3⤵PID:6300
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ui-strings.js"3⤵PID:3852
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js"3⤵PID:7676
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugin.js"3⤵PID:8476
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js"3⤵PID:784
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\ui-strings.js"3⤵PID:8736
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\tr-tr\ui-strings.js"3⤵PID:8352
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ui-strings.js"3⤵PID:1836
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js"3⤵PID:7416
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\ui-strings.js"3⤵PID:1956
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\uk-ua\ui-strings.js"3⤵PID:2960
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js"3⤵PID:7068
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\ui-strings.js"3⤵PID:9048
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js"3⤵PID:8284
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\pl-pl\ui-strings.js"3⤵PID:8860
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\es-es\ui-strings.js"3⤵PID:8000
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js"3⤵PID:6744
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\ui-strings.js"3⤵PID:8780
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js"3⤵PID:9220
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js"3⤵PID:9240
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\uk-ua\ui-strings.js"3⤵PID:9260
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\selector.js"3⤵PID:9292
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\ui-strings.js"3⤵PID:9436
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\selector.js"3⤵PID:9456
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css3⤵PID:9496
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-fr\ui-strings.js"3⤵PID:9548
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ui-strings.js"3⤵PID:9576
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\ui-strings.js"3⤵PID:9620
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\ui-strings.js"3⤵PID:9696
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js"3⤵PID:9772
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js"3⤵PID:9804
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js"3⤵PID:9848
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ui-strings.js"3⤵PID:9952
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\hyph_en_US.dic3⤵PID:10004
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Excluded.txt3⤵PID:10024
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\pipanel.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\pipanel.exe"3⤵PID:10188
-
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe"C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe"3⤵PID:9888
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeOfType.Tests.ps1"3⤵PID:8044
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeLessThan.snippets.ps1xml3⤵PID:5688
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec1⤵PID:1064
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6336
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6420
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6464
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6524
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6592
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6712
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6760
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6908
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7084
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6688
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6472
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6564
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6600
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6992
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6388
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6552
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6856
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6728
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6512
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6700
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:3640
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6452
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7184
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7260
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7344
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7476
-
C:\Windows\system32\mspaint.exePID:7500
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵PID:7636
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7692
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8028
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7012
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6260
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7968
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7748
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7216
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:1360
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8100
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7992
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7720
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8188
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7792
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7216
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7952
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6376
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8100
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7424
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6604
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7368
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7224
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6844
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8144
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6656
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6184
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6676
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6196
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8324
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8396
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8516
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8612
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:9124
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6184
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8796
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8928
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9016
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9100
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8340
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6604
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:428
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8780
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8924
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8280
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8456
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6232
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:4528
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:1032
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8780
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8940
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8600
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7676
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8352
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8640
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:3428
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:7788
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8944
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8936
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8212
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9148
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8196
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:8516
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:2760
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:4916
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:6636
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:10068
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:10124
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:10204
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9544
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9744
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9932
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:10080
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9264
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:10120
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9916
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:5256
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9356
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:9976
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:10096
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1JavaScript
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Filesize102B
MD57d1d7e1db5d8d862de24415d9ec9aca4
SHA1f4cdc5511c299005e775dc602e611b9c67a97c78
SHA256ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
SHA5121688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
-
C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml
Filesize74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\activity-stream.discovery_stream.json.tmp
Filesize37KB
MD5e143d85685bb70a7ff273432d918706c
SHA15a4992e468a338dad00b2b05bb887cb3c9c951d9
SHA256d98b5e1aceec0c71e0335c9020a977f59e4d9b1dde406030876de5547d986870
SHA51294a48003ee842b01817a7a8c0973b73979787cd849aacff4fe03c0681f7a43d7d846f1a25ac3485712d2a5ce4c9467cd5af814335954911e82908f650015f530
-
Filesize
8KB
MD5972414814856284c3aeef4aa10cc447e
SHA129bbcb4f2804e198f2f5a3b4996aee96896779bb
SHA2567d752ceacb24844216f32aabbece8a7f46692670151874eb10643d0506d5497b
SHA512f4074318d18c433243118a0823d4e80424596cafe9ae1e5a6802d0419b756c4781c94801b181d20cd0c26790dc19e2ec8389525d520c998eb773a4290ba532da
-
Filesize
2KB
MD566debcd606bc7137cff1039acef45d62
SHA19f3c151c8b3fe38940044710e8b75faf7737d54e
SHA256d660e85e5ed872485fb04dae0d980d57cd72a57b71eeeb98672eceeda3390c6f
SHA512846c17d7471e4f54ba86caed084c6ba811052ffdefae0827b6a539941e496c0eb6543a4fbbaa2a427838c88c4cadd9e35531206255a9f01b81eb182145f8d008
-
Filesize
140KB
MD5bdd4d5308c26f3de0f3455c22e299786
SHA1d68782c97bc4cc2840ff4125147d6b80ac4fa653
SHA256b28dfcebbdb3a338c15909a1a4855111cf58665e442d67de697f0f140054adb5
SHA512fc4448601a559f3300e3ea22b10711d2a1c673fd088eadcc36cc3889db1087a05f3ff942de3a465bc635a5c2e81ccffa50ac60fcab53f9b8b93a00804fc513af
-
Filesize
20KB
MD54bced3f0bf15e0be957cf41ddd54eebe
SHA105b14d96d372006b0937651b7e3cce2aa4eb62fd
SHA256dfb39133036f9e4824ff83d42c50d99120c057f8305eb470326080fd8bdec070
SHA5123532507f2b48c00ee29d4a112de07b787168f5b5a26458080d67d5565a6219b59bf004b967174dc52081b87e8f415a2eb511b99fca353b90f9b88938eeb7ea44
-
Filesize
11KB
MD5b8ad834cf6c328d1dcaa2ad51a691e52
SHA1191a01701271b23f861528c3d794fc72b89c92e8
SHA2567d807aab81379768f7800cb8079f913b25eb7a67837d7eee8578e3a58ebb0af2
SHA512e5941f97c01c56bba4b53c82c4dafefbb121a81bfa4cbcfa2037af54284bbc4a6ccbfe01a32cb5c0201165fbbc8eee77bc2c8d1f39ed6af868848c7770279c3c
-
Filesize
139KB
MD5562e3b735ab9a759a0db04443610e01a
SHA1f715af20832207adef79d24e7d9b802345b66558
SHA256b3455442d78d05246e0603f5c68ae51407d270ee8cb62718ed8ab69fcfb18f3a
SHA5124504ec4407081df6750cecce2d239900768a32b56c09a861936ef0081446b1eb30fef4a5a300a5cc0bf16e2a0d05525d7cea2795206a22a9c8b59bf85e70a73e
-
Filesize
8KB
MD52a31cb4891164ee70f6ab9ee47e91456
SHA18f4b4b7bd81f7d80aa0e04ab1285e859d64380c3
SHA256b270bac1ffc8bb5005e6c12daeefffb720fcab88ad6a14f1791199c3d6995832
SHA512017b8be0cb2e929cbbe18fd9425fceb94141eaf9b665978f1698e4145e89c6a111c2e6f5d658ab2844a5e85f09ac97fcf4d326a1ad9756f46f08e4427b97cc5a
-
Filesize
2KB
MD515ab4caceecd2ecc5a1bd1fcbfb0c9a6
SHA1a4913b45eddc951c405f2f789cca7608c10542cb
SHA2565fbe9ba39dec7a6fdcc4d1e78d83c16935eb2c824f7323f47df2ec51951317c9
SHA51279de589e5af5df3bbd75235ef607245d4f637e2786357556bcad202e95241bf7cca5e29dea47c4b977933eed35c09b13adbeb0d236aba6961a89604e5e53625d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\096857F5E08C6C669A4DE01F85279DD2E81EFB80
Filesize193KB
MD50cbcdde7ab40529042f74b9cbe078bdb
SHA1f7cc4f9f054bcd3925f1b225a561f8b4bcde0002
SHA2561f4b63bb9fbd6eb5f3900cdf98fcb1b8ba211ae649af395ada4d1054bd142d49
SHA512805155a10adcb77cf510084be1dcc7fe50998a62f35d12db6b2a27d3de2b2086941e6445610f2878201864bed51928b558fb64d8f8936f685e426cb633093c67
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\0A73C6E23F02820E5C7F05AD9890531BF91D87DB
Filesize111KB
MD54f842c33c1c66ed6dba630d5266879d1
SHA15d99bbc4b3d0378263e1e23474fe25039583b83c
SHA25656bbb7cade8bb93c3db2dbafee9e66b632b68aa97da4dab0a6eda159fea97006
SHA5125de3b973361369ac531a61d62a3cde0f30acdec7384996390a9195b01c0e2102ba144372a489bbb30396786e2c81af8b4f4bebde297e36b99e4b5217a8954e34
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\3144B8616BEB72AFE79278086AFE15A5B712EF48
Filesize23KB
MD556948d86972d6858de5072a1745442c3
SHA116014c98513774c791af06913cbdc6e8c6c0dc96
SHA2566420fc07731220ee173fe5d32b8e051290b4d13a95e0e3acc8446d381281cb06
SHA51216e562b40618f38e9dcba98a8358da510b35d45993afbfdad29ce2e66f2156d6c1b87a20616216396e3b4a029cb690d0157c8b930753bc419ac47fe433b73ca8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\3CA5F6C3ADFBCB524FD4BB4F1E58C1959E9FDD54
Filesize221KB
MD5354499a71fff009ea503927390be16d5
SHA1a812494925079d6a1bce6db4b0a26ef6f67b205c
SHA256001e1f2e77e06faeee46a79d4dd23443040408189b2fe73d2b9de13716517c3d
SHA512cdc4083b83d199a46625725aa86655d1cd152377140b613c501e58c39a51560b743849fe18a3d8a0155a155bf32e6d90ff6f1c02aa8ff325f208b460bf2ff99b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\433A6F228D60A54A681AE827C6F2C9517F9A8C25
Filesize141KB
MD57f3be7e384912ea7060f5a92a6bac8ee
SHA1cd93d16cecf288331734ff922e3d2cd1e89db297
SHA256c8b040c86d05e5493324a8642d37e443aec4c5c9d57195e856b35b621c13e4db
SHA512fa25428071edbc3d22fbd47eecb99fbbc5dcaa711d65c7aebc67f5f293ccc83f04d8f7283431aec54069e20c9589e53d7a82e150d8042570e548a5f46240c15f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\43AF6A0B96B65E9C285379BBE64C9DF77572921F
Filesize1.3MB
MD5902345d74720c27b2881c01362448053
SHA11c6fcb6497650d373bf0efa6553eebe274f56ce2
SHA2562c195be8bb12790337e565b4f253dc7c953a02fe9d105da35af6b3bf6e2c5e26
SHA5120b9a9e0ed6587966d4bbf92ed3682bafdac0bafbfc281f9300691131022aaa938423bbf5ef41cb2bb25609f7b1b6e8932b99d29cd393274bb2d539b55569135d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\46C625DB4964C00323A8EF4C60828B52A454EBB4
Filesize1.1MB
MD5e84c8bd439901d930456b8f61c6067b1
SHA137cd2bd7b7f28c7c8aa60ace5baaa26092aeec80
SHA256b7a589028db19fcbc88189f145c7d56e8c13d63e04a651e58414cda40c5b77f6
SHA51265d513a8d73214c899c03fe70c5cc3ff21c465736ae37ae158079c0e1f2821a1974f0367fed335ae557a9e9d08e790d4ca64f273bdcc0e88b679fb3740ee762a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\483C26C5EB9CBA8F8DC58D68D0146414CBD8B1DF
Filesize62KB
MD5e8820d5a07dd17365b615eebbb7744f0
SHA1a05c5690d7c9c8aac72ad660ab06fd74fddaf893
SHA25634e8e101021fe266e7dc2b7752e37145d03f6fb0c522e63ca240f8ad0898cea4
SHA51220e65e27c5803a2efc65645f6cbe20fad2a151c98b18aea4c63d2e5f109147ba24a9c1e205180ed4d8b708a58a339829fa110073071c727355c96e60d1eff8b7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\49AF65C60E9467DC868F8EFFBC6F0E1FE2D6093D
Filesize18KB
MD57e73744ebded6f948046ddc27be419e3
SHA1ce5afd0b51ad1254d7daf04c69fb6604c3845042
SHA25685c728724a334ff0fabc15c43c47c9320eb3468a947d5458ab1bc749cadf8426
SHA51270c4a518a304958dff86e1f820d8841842d2a6b827be262543d45ae98323855a6f3d0885522a87eb96d508a82b72b422135b2e2ea264edf90f6d886d8320b429
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\4C7B6F2CAD8B3C17C2BFE488FBEA72FE061AE34B
Filesize20KB
MD5ac957da1453bd03a3aa8f3bdeff15f92
SHA1af16fbc54cfc6e13eff7c0f05ac51b3c0281a6fa
SHA25637359ae636a9c77dbe83d245c935d15dc84874271db441984b54b32326ffa9a0
SHA512e6b508b584a58789c655416f232cb5d2f50c65b85305a705015467ba850cd0cbb3ee38ed62f680e257bb683c2d162c6d467a4368ce6c1e6ff100263d2cda59d7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\64734067DA3FCAD3A190A95377C1AC95EC2B62AF
Filesize314KB
MD5ec48a147db49ac9206f6129c4e98140c
SHA15d3b6c6b389d6df76fa83967b52122a6edf4e2a6
SHA256e1d6fca61620aa1a2b0511cc5cecaafa5083675649c5704ab79a7586099f222e
SHA5129fdbf213913d134659fec4e42a591065e97ea93d7b5707462c30e2b1fd0b0ffc5ff2f8093a5b033a026703f70753018cce1ccda93b9928f942841ad55810aadb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\6718705F52A6665651669F64F054BCC011C4766A
Filesize71KB
MD54fd6ac8709de128e27a20b046a594467
SHA11ce03f97af7b4163c150a03d5fc8db9c534f3ebd
SHA256edd13a77f919b67031fc6dcaf8ed50528f65f32d625468260c31ee6343cb33fe
SHA5121714b7b5f38bbef7723c4175802c9deb7309a196ce4868642a7c3774fc59c4a9c8df1bc4d7436c9554b5f458256c2bfb813791ab9d784dbaf7250780a1e009c4
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\78C5602AD9B870C6C4D381677456A348D0186FE6
Filesize97KB
MD535eb387bbe01aa7451f4c2bfae8374bc
SHA1f6dae0f13efe934b8634925d7df4a24c69bf852a
SHA256f4914764b88bc2b24be98c8ef669d789dd5d5e0e609a2cae5a263ae4729249c3
SHA512c76cb9512898985cf37807fa5e7ca4764dc11c352b2f028232d834a76c1a617e14397aa3ea1403deeeac45d79ea5afb12ac82a4857fa799d36df12e5dd5aa74f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\81C43D6C93D6C3C70F6FE22C2A50F882FE508261
Filesize17.7MB
MD585b71907ba9675899fb286fdea02924d
SHA1ae7a6be12c86454647ac27fcd4eb75d667eab42d
SHA256bbeb2e172c147b874d50a4d538dce8f8710e8f2d6db2bc263f008e3ee0627624
SHA51275e39ec36358bf842a536bb78ce7633970c271111ffe5f395c29513b2fc3ac3e1faac6856befa60445d4e001e1d0c346520167be591295abd22a3173781ed705
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\95C428016AEC768E5B25BA5D7F4D1D5F4F438692
Filesize23KB
MD5ec8711974ad08f3e7938b51f7bfa3ce1
SHA1c38df69f30c190153c9ed60f8a151f1569d12a18
SHA2566d8e2e66ee5b13be22a16cedb901c6912a33a6a8c0899cdba5e5f4cd8f336605
SHA5128d3f4ac672b51c77b4f902aeaa4f295a5a37ec3c5d43bac6e774b59e20d1dcc5a88f7b1a4ac6af663ca23d35fc50bac79a67f21b1cbad091530e27d6cc2da2e0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\971254C7341460E85C93D0821B91E9985A0B32D6
Filesize2.0MB
MD52a7402ada29dfffb0e46963fe37378e5
SHA1edfca0a4e3b8cda2137b2bebebad08e04988f38b
SHA256def79e310f55a3ac55eb794e52bd95739666b1895b2e8c299c32f19ff70823db
SHA5123253ea96045cbf286ed24e039c7c6b9efd8727d5fbc3e012a5c5355e210f66e09a06b3b621e1bd30a18bf882f8eb089b4122b84b774b768ca3d316855152d57e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\98AF737DD946CA3B37F8CD63EC1E1756F57F2E19
Filesize68KB
MD55d2e5bd5f752829f3472c192a7026ede
SHA1a1f55fe46626c85c2c94a4886a0a483e25a618ca
SHA256f5aaa483e12e1b8e9f857095f3521804a64b163f16988a7d408885b2be692123
SHA512091949d581f5c6b03549e745ac39820774b71119d3d6899ec692ef67e9285c85a5fac536ed52c433f86b46bc595cdf6aac69f7f7273da0c62c7144acaab48625
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\A316A67D82F673191BAD9C75885EB5E7557D7EFD
Filesize48KB
MD53e664ae18082833305007c8c3ba0f8d8
SHA17475e1d75360a971192816bf52c8346bdc1f769a
SHA2560bbdd616aaaa61cc65e78453a96eb5cf7427af2a2453b9e7bbdd198c5ee9ea00
SHA5126dba9e0b51405248ccc841891b3acd7317cdffa6a3844e475534fe4231c12a3dc7057dc6d599682658090f09924970173a78efb2d3386fc35f3845d11b0c4165
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\AC6959268E349C7B5497A3867D6DCDC4D543431E
Filesize13KB
MD531772e694007dcc8ad7b31bf45d00ef5
SHA1c5f99c5f1a92f3d645c4111ba9110541cd721a4e
SHA25642a6f5407a637f5ab42b80998952ec8f5aee2645d6ccc6601cdbdd8c9f168407
SHA5128518354259c5e96ad32976e9e9cae532d5fc1a6e56f388167483f5bfeadca22a3108e8ae4e1e15bf71cb74683d73975ca699123c161795075796acd852d484dc
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\B02CD1705679E135A9D4633C85B218F56B1443BE
Filesize141KB
MD5465875e02e2604e696ab757360ebb298
SHA1519d6f91a195bf9045e60343624f86f71ed7306d
SHA256f491727c48b950e2a413833b5b9ca471c6f266d4f5dc30baa7eb2f0b91cea596
SHA512465c72a26fed6345c171979b4226c614c12f4edca0a346470ba917b64bf4dbdb0a618a14dc24ef7e6701d30150d31b15939bcb30a350bdfb7b492d16f3011d8f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\B9180073CCEB60CB50EF2369FDBFBFDF35BDC239
Filesize137KB
MD5f76bbef56796d39630e883318fc496e1
SHA151a2d7f5c8e5060d818249c62ad0a7bc17f0762b
SHA256d66b37a72ac0e79ffa52f17e35a24d2fa390b608100c8b84924b8ee5d175bc1c
SHA5126e0e106ef666a83f53351c9472b0b20a1b32b3fd9a56e881074406ad8888b3c41ed0c808cdb02bac3f406d90a188aed8f9a92037ee4812eaaa8052ed9b6138b8
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\BAFE7053257E4A6F92E44C444D766B2BD718F658
Filesize419KB
MD504f285defd43022fa39ce5f1895d8c60
SHA175806b0f481c81f2b44a7aaeb890a4c5f24dd3c1
SHA256dd3094c6b415114cec8dacbc70f3a9b63550bca957a508d28c704d966fd7ec80
SHA512b1146b9bf0b9d201cfe20a3577deba5adc9f22179598f37891d9f81378b752cfc855a3de889e903b36a2dd1b8cc09a484ac3ad932b544269ed915bf74b4fd228
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\C08A59B3B1595F0BDB04750BC2DAC00002FE255F
Filesize65KB
MD567c26e84c879ea97783a6d48099d0018
SHA1d960f6057d1f7dc5b1380cf595ceb8e32da161d9
SHA256eb81072782ec55d807a2a99890522f692207f870685c76f48a07410d46496f79
SHA5128032de5851d80fbdeb28e1f9bc4b3fb53e766fde4b5e615709fd23935bd0078f38988ff3982b17f8d1cab7c8c0a37c17dc043988094795d22613b9176a655a51
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\CA0D004BD49ED2AB4AF39A42DC78C64404D5F84B
Filesize601KB
MD544ea8010244ed0faf8feac19eda2dbaa
SHA111cab0615e3bc3f36cbd3e1b4f82221bf6402892
SHA256792def60f0fce5abc49b996e10c20ab51c422db8c3bf857e122fc7f654775b8d
SHA512b7903ac30153bcef3faaf92146542c5428655ea621e1ce4e8501b4d83c4dbcc67d9203edf9cd8ff70d5f982472e4ec28a40d633fa8dba526e34721f38737657b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\CC9CD9140B98DABCE0033FECFDF6BC054865F0F0
Filesize22KB
MD5e1dc81ca46fb0953b05fd1f8a04d783b
SHA1873f637ee4b5dc57ed843b7ffe1e364e54b763c0
SHA256acb578e5cec14b1201048b3cc6d4810b7b466d705124490ba375e689aebbf702
SHA512de278b52be70ee6b2a4582f253e364606d89a3c2289222e8d8353eb54581ebe2b574ab17ca416922281c3a504fc1868d8cd83125d2fbfbb0a973da88cfba7213
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\cache2\entries\EEDE8538402212B7A81E3E4AB009C20C0301B3E1
Filesize89KB
MD5af3390c520cb56d45d8863cbc1b9819f
SHA1c0cabb1dcd62f518193b1b4d38811d390796bfb8
SHA2561a25c79483a7a42031bc1aba05588116c18d9017daa3ec6d28a364ddf6e859b6
SHA51271910a9bab35d90437868e3713719b16ec827c948a4ca1346124bfb398f4b7e391422533ca09e0265b9d00b728a120fabbc7995849e464a106d6aa59e82ebc6d
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\c5nsco79.default-release\thumbnails\d6d02f037c579de67528c9da5f5b83b6.png
Filesize2KB
MD533398bbb1dad5f498a5e192dfd338f97
SHA1bb3981c816235b9cf8a12fbd19728fdecde26447
SHA256a965a1cc8dd3dbcb86d5b0b59eceea489df353cd7de05cae5147635b79f41322
SHA5122248cc7aa09d5e9db7c19d9f55d6006ce35e5f0a46b7edec6948ec78929b69b5a2124b2c69a5884bd2a90728f23aa3fd88ccb83b45ebde5213cb36001642878d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B9ST21QJ\styles__ltr[1].css
Filesize55KB
MD54adccf70587477c74e2fcd636e4ec895
SHA1af63034901c98e2d93faa7737f9c8f52e302d88b
SHA2560e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d
SHA512d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\B9ST21QJ\xvEz2IbMlyghPZ3oNAHr9N-xMOA.br[1].js
Filesize6KB
MD5dc221228e109f89b8b10c48f2678fb46
SHA11bfc85cba5c424136941ac1dfd779a563b5beed4
SHA256f4fb7234959f48c2b2ca73fd6c35d36eaf65d8c431d982a1ba208f5cdc766419
SHA51246f49e5ac18436251778d1f50c027729a2442ed6541c3162d878720703e37797b6028d96eb1568c23ec5006fb022c8e05855e250d6a1a590f41e890866529cd2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\O9XLK0FV\fRSNKQanUHk53F1a1Bi8UA71Qt4.br[1].js
Filesize289B
MD59085e17b6172d9fc7b7373762c3d6e74
SHA1dab3ca26ec7a8426f034113afa2123edfaa32a76
SHA256586d8f94486a8116af00c80a255cba96c5d994c5864e47deac5a7f1ae1e24b0d
SHA512b27b776cb4947eef6d9e2a33b46e87796a6d4c427f4759c08cf5aa0ee410a5f12e89ca6ab9cddd86c8471037e3c505f43c8b7fc6d8417f97f9fe3c5c47216bc4
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\O9XLK0FV\recaptcha__en[1].js
Filesize537KB
MD570306d36ce9dbcbd8e5d1c9913a5210f
SHA104949ad636f8cd09bf91059bc4aaf1973c92a15f
SHA2561425b3dc4e809e5488aae10e2eb2511f652c6a9c3845c98c3fe69f07fe0c9e2b
SHA512a7f00ba83fee80e7f2006c9e1f0121e2e515f4956182924e67c95a8c5522f30735f7bf4a6f7dcf3cbd29a685e967b1c4ddfd72d7f1f4cefbe55326becdacb275
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\O9XLK0FV\warmup[2].gif
Filesize43B
MD5325472601571f31e1bf00674c368d335
SHA12daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
SHA256b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
SHA512717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\TUTH93LG\www.bing[1].xml
Filesize97B
MD5efa1b9e3c3ddc625242ef3a67d8d5945
SHA17ea5a3fd1a9486babf5d0c9ad07af8dbb7250bf2
SHA256bae32c704cb7f20d8b786baa1b012fa5b3ceae1c6429f54bf61ca85d2b5f5bd6
SHA5128742def3b2c1eee023bb81d838193dd95ad4b075e22b856916c1107d6ad11401545a00640c49dd628f2060f0479898a78954c11bccd1de99954f62cbc6654338
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\FV55U5KB\favicon[1].ico
Filesize758B
MD584cc977d0eb148166481b01d8418e375
SHA100e2461bcd67d7ba511db230415000aefbd30d2d
SHA256bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c
SHA512f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\LD47XG50\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YUVAOZR6\favicon-trans-bg-blue-mg[1].ico
Filesize4KB
MD530967b1b52cb6df18a8af8fcc04f83c9
SHA1aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588
SHA256439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e
SHA5127cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\YUVAOZR6\favicon[1].ico
Filesize5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF28ED87D502A03CFC.TMP
Filesize24KB
MD5367256aa0788fcf026f8a7c28f6ffee3
SHA1b8116ddeb858ee93b2c183f6eabee015d356bf04
SHA256ba04da18d4d26d2a899184fad76218e0c52b1a8b94dbca7b1818f9c2f1b242b1
SHA512025bfd8210b06fdc01d8acbd4adfc8ebaf06e08dcedad7820eec9de688000dc877ca52e55995c2e8523cca5d4ba36151934c52c1a21b5eff0ba7feb84883801c
-
Filesize
136B
MD596796accb412b878abdde67fbacefa2d
SHA106f7546ed677c26fd9325ec94e4bc8ffd8918e5b
SHA256fbca13f9c49f1fa9f025dcda711838409425cebb3ec8c9d00ec23fb93adec377
SHA5122918fe61084e59116a0c1af28d656729aeb7b77a07464514dd9a3fcf902801ccf127a0a35ba61341361537cffbd38d72082d9bb517336fffc20f82d3b5af574b
-
Filesize
340B
MD53867f2ec82a7d77c9ffefb1aac8b7903
SHA106fccf19b9c498b5afa2b35da00e3ab28d56f785
SHA2564e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f
SHA512b413994e5b9f0ecb956055c7befff14845b56bb658fd8280d3213fdfa175ff76bc56e082174f2475fdf2d1f9eff618ebfd80ee2b67c091eaf1fd9c94697da5aa
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Filesize933B
MD57e6b6da7c61fcb66f3f30166871def5b
SHA100f699cf9bbc0308f6e101283eca15a7c566d4f9
SHA2564a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e
SHA512e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Filesize1KB
MD559be56c09b3dce8d6ab9941238d3fc9f
SHA1aa39c7ac4e10d25f2349ca250a12b924183a0373
SHA256a00d25f3a2bfbc00183f2da62b47cd5ce06c8c272c9ba59e0cc69f4f309698d7
SHA512db4aa2967c786459abe8daa77c5b269ef53e5f87b5c53e06e891ff1241d23c8859382c48ecfec3f400e4103ea4aea7a32d479a66a11d944f5f94245cdc0eb9d7
-
Filesize
702KB
MD590f50a285efa5dd9c7fddce786bdef25
SHA154213da21542e11d656bb65db724105afe8be688
SHA25677a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
SHA512746422be51031cfa44dd9a6f3569306c34bbe8abf9d2bd1df139d9c938d0cba095c0e05222fd08c8b6deaebef5d3f87569b08fb3261a2d123d983517fb9f43ae
-
Filesize
510KB
MD573d4823075762ee2837950726baa2af9
SHA1ebce3532ed94ad1df43696632ab8cf8da8b9e221
SHA2569aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
SHA5128f4a65bd35ed69f331769aaf7505f76dd3c64f3fa05cf01d83431ec93a7b1331f3c818ac7008e65b6f1278d7e365ed5940c8c6b8502e77595e112f1faca558b5
-
Filesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
Filesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
Filesize
780B
MD593f33b83f1f263e2419006d6026e7bc1
SHA11a4b36c56430a56af2e0ecabd754bf00067ce488
SHA256ef0ed0b717d1b956eb6c42ba1f4fd2283cf7c8416bed0afd1e8805ee0502f2b4
SHA51245bdd1a9a3118ee4d3469ee65a7a8fdb0f9315ca417821db058028ffb0ed145209f975232a9e64aba1c02b9664c854232221eb041d09231c330ae510f638afac
-
Filesize
469B
MD5aec412d3732f2b0acaaa120f4fb90a9d
SHA1ee31d77c300e991d73a06df65ddacf7a47ffb461
SHA256fe850ecc7f3f8d4977a68b17c2480997bcf4f8fd24a41845c52b4a4277e0532b
SHA5121f53efc77c7b38daa449f9c497161324f197772629302ae3205b5fb0f14c3a1533e6b6e1ce3632fc315af37643d249c4a15afa0b4ab6685eee5139eed83f9dbb
-
Filesize
219B
MD582a1fc4089755cb0b5a498ffdd52f20f
SHA10a8c0da8ef0354f37241e2901cf82ec9ce6474aa
SHA2567fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa
SHA5121573a0c7333accef2695efefe1b57cba8f8d66a0061c24420ee0a183343a9a319995267d306ee85084c95580f9855bcdf9dee559b28a200b27fc3cc353315e78
-
Filesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
Filesize
53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
Filesize
77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
Filesize
38KB
MD517194003fa70ce477326ce2f6deeb270
SHA1e325988f68d327743926ea317abb9882f347fa73
SHA2563f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
-
Filesize
39KB
MD5537efeecdfa94cc421e58fd82a58ba9e
SHA13609456e16bc16ba447979f3aa69221290ec17d0
SHA2565afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
-
Filesize
36KB
MD52c5a3b81d5c4715b7bea01033367fcb5
SHA1b548b45da8463e17199daafd34c23591f94e82cd
SHA256a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
-
Filesize
36KB
MD57a8d499407c6a647c03c4471a67eaad7
SHA1d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA2562c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
-
Filesize
36KB
MD5fe68c2dc0d2419b38f44d83f2fcf232e
SHA16c6e49949957215aa2f3dfb72207d249adf36283
SHA25626fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
-
Filesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
Filesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
Filesize
37KB
MD54e57113a6bf6b88fdd32782a4a381274
SHA10fccbc91f0f94453d91670c6794f71348711061d
SHA2569bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA5124f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
-
Filesize
36KB
MD53d59bbb5553fe03a89f817819540f469
SHA126781d4b06ff704800b463d0f1fca3afd923a9fe
SHA2562adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA51295719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
-
Filesize
47KB
MD5fb4e8718fea95bb7479727fde80cb424
SHA11088c7653cba385fe994e9ae34a6595898f20aeb
SHA256e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA51224db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
-
Filesize
36KB
MD53788f91c694dfc48e12417ce93356b0f
SHA1eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA25623e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
-
Filesize
36KB
MD530a200f78498990095b36f574b6e8690
SHA1c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA25649f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
-
Filesize
79KB
MD5b77e1221f7ecd0b5d696cb66cda1609e
SHA151eb7a254a33d05edf188ded653005dc82de8a46
SHA2567e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
-
Filesize
89KB
MD56735cb43fe44832b061eeb3f5956b099
SHA1d636daf64d524f81367ea92fdafa3726c909bee1
SHA256552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA51260272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
-
Filesize
40KB
MD5c33afb4ecc04ee1bcc6975bea49abe40
SHA1fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA5120d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
-
Filesize
36KB
MD5ff70cc7c00951084175d12128ce02399
SHA175ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
-
Filesize
38KB
MD5e79d7f2833a9c2e2553c7fe04a1b63f4
SHA13d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
-
Filesize
37KB
MD5fa948f7d8dfb21ceddd6794f2d56b44f
SHA1ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA5120d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
-
Filesize
50KB
MD5313e0ececd24f4fa1504118a11bc7986
SHA1e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA25670c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730
-
Filesize
46KB
MD5452615db2336d60af7e2057481e4cab5
SHA1442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA25602932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA5127613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f
-
Filesize
40KB
MD5c911aba4ab1da6c28cf86338ab2ab6cc
SHA1fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA5123491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a
-
Filesize
36KB
MD58d61648d34cba8ae9d1e2a219019add1
SHA12091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA25672f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA51268489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
-
Filesize
37KB
MD5c7a19984eb9f37198652eaf2fd1ee25c
SHA106eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA51243dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020
-
Filesize
41KB
MD5531ba6b1a5460fc9446946f91cc8c94b
SHA1cc56978681bd546fd82d87926b5d9905c92a5803
SHA2566db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
SHA512ef25c3cf4343df85954114f59933c7cc8107266c8bcac3b5ea7718eb74dbee8ca8a02da39057e6ef26b64f1dfccd720dd3bf473f5ae340ba56941e87d6b796c9
-
Filesize
91KB
MD58419be28a0dcec3f55823620922b00fa
SHA12e4791f9cdfca8abf345d606f313d22b36c46b92
SHA2561f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
SHA5128fca77e54480aea3c0c7a705263ed8fb83c58974f5f0f62f12cc97c8e0506ba2cdb59b70e59e9a6c44dd7cde6adeeec35b494d31a6a146ff5ba7006136ab9386
-
Filesize
864B
MD53e0020fc529b1c2a061016dd2469ba96
SHA1c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade
SHA256402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
SHA5125ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf
-
Filesize
2.9MB
MD5ad4c9de7c8c40813f200ba1c2fa33083
SHA1d1af27518d455d432b62d73c6a1497d032f6120e
SHA256e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
SHA512115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617
-
Filesize
64KB
MD55dcaac857e695a65f5c3ef1441a73a8f
SHA17b10aaeee05e7a1efb43d9f837e9356ad55c07dd
SHA25697ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
SHA51206eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2
-
Filesize
20KB
MD54fef5e34143e646dbf9907c4374276f5
SHA147a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA2564a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA5124550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
-
Filesize
20KB
MD58495400f199ac77853c53b5a3f278f3e
SHA1be5d6279874da315e3080b06083757aad9b32c23
SHA2562ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
SHA5120669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
Filesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
Filesize
330KB
MD5692361071bbbb3e9243d09dc190fedea
SHA104894c41500859ea3617b0780f1cc2ba82a40daf
SHA256ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
SHA512cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize4KB
MD52a938a866d5cbb0db5cb0beaa8730743
SHA16180cfe31d662ff1716ef2d6033799d782e04225
SHA256e648354f4114d6d1c9b0922a540f26bbf1104297e2f443ac89046081c296994e
SHA512fee60f1c281ca0cd77d2423fffb1f6c0ebdba5cf71f4f72bba29ee17d3d648eeba1f1d08c17547ec4c2ee1fb685c21ae073ff486dd2174999d54f649227354ea
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize7KB
MD582163e7685e26ab5a8fc8da57d6de0dd
SHA1b38a4f434336690cdd68c3aa7f7f400ca44cc5ef
SHA25627a9e7bb267df23ccd371c6e0479eb882ad6c98b64ff8eecc1361896df962178
SHA512a6233d4e0282315a257112bc4a18d2090f171c7e22a6e61742acbdecd2c896ed939a51ebbbe25ba9bbda9cf5405bfe2b4849fb8bcd44647844e28bd989509343
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5307820ec4d048b2a1e999c09c6d57bd9
SHA12991d5fe3a729e6f8b2715d21b9c31adeff29c8a
SHA256edd0c6562dcd02702c5a793b146d60968b9aacafb117408b9d3662a0e09925ac
SHA512f98ed4b4fa710414c4ac55090002d225f13e7f34706275ae49e4645ad2a769e7baedc34979d5e34ab2760aeeed24d6adf81da08f0b1373ecd11d1f87ce2a088f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\682e4f89-d611-482e-94cf-5d877fbda32f
Filesize746B
MD57b3f8d67686c7e5620ec75424cd9a15b
SHA1c9164da59598f11395716c045a9ab718244aa02e
SHA2569f9c1902ea14995e3a41fe578eaf4415c4c0d195a86edcec0c07e1b424aa763c
SHA512f0848683e16628cdb01560e95b6d2a69bd8e4364bb913adc82e7df600b5ac9281c03e75d698128127e8562edaa004e054912f5367087dff5f2dc05e314037625
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\datareporting\glean\pending_pings\bfc8a534-8e10-4075-bbcb-c8983e298e65
Filesize10KB
MD5d0300c78fd9c2e3ca38d43abd2029c34
SHA18f4fad1ba7e199aa8308fa0410f60a1eebec5166
SHA2566d9730c0c8787fdb396f1e4418fdc8f8ad6a740e547cf5f3db2714ae291c1530
SHA5120bf23f746a74639c4b5eebe567dc4c16d62f468e36b52ddbbbb36be4a2f73c84374f059fe60ff349e25e789bc092516476dd9db8643eed933cb8ad4196c64b02
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\extensions.json.tmp
Filesize42KB
MD5b244ef7e821ea9ffa80e847c1304ba49
SHA16a4a02d5937996c24305d067d248c51fc5c537f2
SHA2560d59e380ccf8bbe86028123767242b69dcfa112562b8a02dec223c07e49971b8
SHA512d1cc22191a5dca54389f0e6ad70752cf3cdd883ece1df2735abf003db1cd59386fda329cb0f410f69e56e8cf60844a7c2ca17131eba37310559b31f03eaa7381
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
288KB
MD56cdb2cdc998f73f10ba35aa64a253072
SHA15c2ca02596e43b229d50f57fa2389755dfedc2bf
SHA256a9d37f3518aa56fe6a3e90860625429331fb9064c30b8d74179ab6303b34ba5e
SHA5127b644e29c1d1d5969ad05892750c03e1e72ec8ab176951deb24c580232aac68741b5a3e4008f260182df5b2c3053669e31e4055d6d6c353a40562ea5c6515786
-
Filesize
6KB
MD518088ad6b0aad2365145aca21e5a1183
SHA10fa4409d3ad884951f1c1adcee37fdc155fa7089
SHA2564ffb7b3759392b78c73b5c9e5d67b2224df12c0aa22a0701900f4baf67be0e82
SHA512a33dd441a382c9583e0f0bce1b02942af4a72229e6b402fb6d02fbd5fa5130cebf54efabf5848ae9ce43b9369b693e611f126c415d610d8648a5ed5708aa6392
-
Filesize
6KB
MD5d391f4c292d857588ebd8afb5cc8dec8
SHA1689964362badb99df0488b8c252d6f8838960fac
SHA256c6f19fa5a4ef3df038bf57a52433e6fc6c302b3f731985c9eeee158333b7e367
SHA512c59d61e9aa2a43c2184d54e76d2e7852d2d3b6d9a7522aad93b13c8ecbd574f0c8ebd0c889a55b744ad83f92046791d1400d4f04ff0074aff8fd698182aa832c
-
Filesize
6KB
MD5b8aa3f379cc99baa9a35b4f70587952a
SHA15896b8495f432227a574b4e91afdb488e272ae9a
SHA2566b3389022e465045621b5de170b0c68dae02b432361b1c7207c6299bf67e5c7b
SHA512562a27e24b7f85b0f15604a3bb59e81920da9860675222f10e331029f9b69fdd4ed5594371dc04bf9abed402caf0e7d304e39e1a66eddf506997a5579d089c5e
-
Filesize
7KB
MD5d5df05221eff91bfdfab9303cdf66b4a
SHA119a9431070dd41a7f462b0a49db02280ba9685b0
SHA256450b8b9c76f0d61180d79426c90b046485639a14aee4fa9bd06d0b2e310773d4
SHA512def92c83a17970f31e3c058f349f6bfb1d4a170b63e260ed84b469370d03828878573c9ba1b40b210c887a1ecbaa68657890463e290d06422f668d83c235ad3b
-
Filesize
5KB
MD5ee365aa367fa3d887f3d069093b4b55d
SHA12a1bf063b83274fb41dedb255c17ce8c69b32c95
SHA256ef6321ab49a89a7a1c9750a8bd291471ea76ea4cf406251676ed4241ea9f949a
SHA5129055e7774e0dbebe4efa43bfbf9ae6f601889cd263d28aa8e2d96a8eff4472edc5a89532f4a6a86a3b925df1c3a9063c933ebc4876dc05eb737f782769258a34
-
Filesize
517B
MD590cc3cc297fe0ec557bfa54c96cdba02
SHA1b8579a652720bab794468917a487c513736c2c03
SHA256878f28102e0f6d295d9797b2e002bb5109be83e2fe460b656a2ce425790d2a53
SHA512b3f736dce509481866e6cde5d7e289fd3f3bf54bcc2e6d7a8cfa0719a2cf82b2c953302a76d539cc408078dbe192d6c887485ef131d71aee1707efb09858fbea
-
Filesize
5KB
MD56dbcf0ed72b17708da8a4401b16714e9
SHA15d5719129d9464b204b5fd8a1abcc68be5b419da
SHA2568c7e3535c1ddd39e0d8190c7071db923bc47deb7ecade3001b473efda4fbe89f
SHA51230733cf275d065619e62decb80460e0e59e1b7a7cd578c1f57fa0d6a37ac4534ffeeadb11b22f3c462b7023e4a7bcf303a7adcdbbb00ef318855df5c8dc330c9
-
Filesize
2KB
MD51fbbbed3c517a110078381dad0b0345c
SHA12020eb74ab53c9e5ef0f8d82e3fbc9d1ce06a02a
SHA256fe40e26ba1837edb3d9626309cad4f29b080990f69e9cb43a8ef95b95d641b07
SHA512bf0083c266fc1b131cf2967651e4ff68453fa70452b0017f33b7b2994dda7214034af8bad3d21d443ff2b148a1d786007699cf74570c7adca92cd33a5136a098
-
Filesize
7KB
MD577d8a19c74096c4b7826ccd2f18eb36d
SHA1543f990b0817a744b607cdd2617cfe522a89bce0
SHA25625452e31dbac5fcf5e3fc8cc75fee693666d7c51420c342aad96bc904abe26f4
SHA5124094c13fa8f6cbf36439db942ff8312a57e55451184d00d230d2a1367ad14d80271198f98a8cd3bf522d09c05edfc08e5e76e1b8388817aff4075ce30710bed6
-
Filesize
280B
MD541d220d4783f67d2b57beec20c135229
SHA16e97765e77920b6010fac2cb4abf1e3cea106541
SHA2565d1881e74d76b95bad59439bb5c7676258a4ae6b6d853074e93b5247cf1715dc
SHA512dc30ddc4c8cfe598de5e24bc88cebbe4256fbb21a0b1db6c2ec15311053e7d8be6a93a0bcfcfd8a02543f8b9cf9b15a5840154b272a2df71d59d7dfd80984ac0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD543b2ed43a7775f8a1f863198656247bf
SHA14297853371418bc1ec362ce5c455fd81568a51d6
SHA25638fec2f4aa4cd00673e6769023fa1ad27cb5c221bd1c65b30c38d3e2b3f2c86e
SHA5123a860a1ef1520f904cc9151f4d059732b7bd1cea07f425f9b21eb38f18fa332efb64842f2a6615a937f8f049f7c46e43c4950867e882b6b4495903a19e310096
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD52a4c6e68a09a944a345c738ba4eb6503
SHA178abe9be8858955b3bbe42dce7bd9e0c7aa9eb8e
SHA256c3dfe29c2bc5a3502c2ab5d1d301b2e2f52da9cc5cebcad2fc083ade6a6c6f29
SHA512d3877e85e88aa154f4c6d8fa967751415b9312d39dee43c17e7a0663bc7f7ef500cf042592835a9878fffbe2c2b21740ea5bbec4034349ea650cc1c40662867a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5210dfa8d1971650b53fbd74def0a76a1
SHA193c7b98a35b70a13ece8d53c0f1ff5179392334d
SHA256abfde7baff711e0194f2307ebb7cf9bb9469e7606f384e6479f11e8b4ff4bc36
SHA512712b03b0d4554bf2c23df8b6c53c01750c5876054455a9c9909ac1b39ddd61b8e1cf8f610399f798c904f540d4dd04f4476b027e9ab98d75242a56b60e2a650b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize2KB
MD5c76603a57bd16bdde042b356a57bad03
SHA13f98a5df333445664629acbfc3bcb635aa13c845
SHA25699c3d2c28034c15337b260d06cf36dd91e2d1b6cfcc388b7086f18f8fcac25bc
SHA512077aafef508afc589c54c7a117efca2bccad894ff37de174d6fa6449eb467e37bb313765c39f3fbd2831312585828d34b01b525440e70aa564ec3cbbe0b013d8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD50049cbdc4b0f34e1b5d1b6bdd24c455d
SHA10986bf6424a962c636847cc937eb7b8d75b440c8
SHA25672c1001077f8f1ad3ea04a892f5826bfbbccbb30b07ab0222e048ed5fee7e953
SHA512ce0ce03b12f99363c41ec1db094baec2f62aab8fa6a7d5979f88d56e063ddbc9b1335b8de157f0b5087a683cfdd8b87d3fa9de59f3155fd46a9b88988b8f501f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize13KB
MD5bb54f2561ddca90156f6cab8fc98bcde
SHA1f7aee72fceba891c73c5d49b035de408781aa336
SHA25625895610f61a2c63af3e82ef80eda275fca3876a7e9b8dd94af46ed3f97dcac6
SHA5122e5fe77bf07446557e9b8183f0981b4408cea7dd95cd03c7682dbfa8aa7eb7b1131c8691096a6c19c9812bff87c8fba1bd0f42639e33e3d27adc9fab57d9ffee
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize7KB
MD53ee2d3f606bfbaec2315b1acf441dfa6
SHA1ee345e1d19ff7ff6535f5f6264ceaf51179558af
SHA256a9fc323f94b41438a003547e3985fc0621b0a899a409018b7e6615adcd324eba
SHA51213e47b075d142f59bd23111c33d2e7f082337f148150a4dc3b3b2fd3f53653dd76cf0b70894bef06480977e1690471663db761f860cfe649f49f334d6dd97b00
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize18KB
MD50db946f7386a8c93f6180c9bfe4940aa
SHA1694caa427abc97224ff012ec55a1ff1ca3f71fde
SHA256ad1e5569d5d86570a212368192279d79cfc207d215db6c2337acd61fbd8f56fa
SHA51252968903cf5edd0ff15c0cd19f9e3cfc3e2d363b63ad142f75613dfa5542407e8a7c36d38ca47a4128644dc44b2d2b977bcb91624364651b8e159762d62709fa
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize16KB
MD58d0a2ed5158f6899008708ed16aeb775
SHA1bb0bfdd34f62a5f5991ce5be0f9977b6b39dab30
SHA256f0f47b27758683e718bf952684d773dcb30af283c0da84c1e837ba63e6345887
SHA5120c026b1f2eb615d44a706f31219115a85a60ab62484ab3d7ccc29226b6ae0dcbbcb7267ecad1004c0761c8c8de7bce56532cf959cf7885ccade52096b2cd21f7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize22KB
MD5229402684dc47ad09ba342a9ede19616
SHA16517709475ebe511f541518449aeb93c172b6213
SHA256d231b4035545fe6df720c1cade21fcdd34fd3a565388e7258e6e3fa33220ac39
SHA5128975fec96f43e10fb17f84e61d7fd8b752ca4f36af3321361b8a6a8e2b2caf34fdde044de3980d7ef97678758912575b475b05b9c2b925240f1a035ec5421050
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize20KB
MD5e2e9e0829901565fa8db4493f14bd687
SHA17dd3c807c3705465302b1c67df463b443eaa0bba
SHA256790110200f6e33551375e85579ad549468ee38f295b7b276fbbfd97e8639b9b6
SHA51204aa8ec7c7cf09a595d7708080214f4c837c4047a3423da4b2079fd265c939935151919fccb647256e6b950bea0c541e75646f2f732e9cd00e40a6c04d349883
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\sessionstore-backups\recovery.jsonlz4
Filesize22KB
MD537531cef6a168847f7ffc2cb848415a1
SHA1c811dab5a6543f3647b71dbcf546d755b00f3240
SHA256419ad7db6f08cfd6e8833ebbb70acafc0afadaa60c7e48c86634b04ce31d4d9d
SHA5121f0abd4eed8b911a536fa6588517813766558c8eac1d7ccf014a429007f868c5ba79d3f8929000ebaf163556089522f9396baba8e7f0c40fb4d5663dab49a56b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize184KB
MD50ed2663971e8051b2bcb574926400fa8
SHA1467756bf41c377bdb07c8be10d5391f1df1d80a7
SHA2560c44c9887ebd30506041e4f483422673660df0b74c7468b0cab2c69bee1f4e8c
SHA512e521f02d0a4dc70e3bb33747c5113c76f18f15b4370826ef13700c4f559c8b158ed1d8ef79d7d88794bfea61496a75d653237391f2f8b5e53d8574a21f113898
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize192KB
MD549dc5e81195b9537e8d1232660777f22
SHA1586565a4208248f59580aaeb58b70f0005451f36
SHA256d6da9198865299572fa72b98d2cc1fc85a210cc75a77e10b0e2dbfbcf9a886f2
SHA512311e6ff8ef3d6d4bd38db723a776b21ea7c4373fe412185dd083abf187e5ab8fe0f1e3d7a13bd0060856bc7696b4f0d3154bbefa5fddcc5bc2bef35cd38430d6
-
Filesize
6.5MB
MD505952684ed466dc692172d39f663c037
SHA1d1dd0da7763a602503d1adeb476c3b0e550d16e0
SHA2561e7d04d948f61e9c1b035a6f84bf2468a33d65be42d44132dd7c46467a47c0a9
SHA512968cf0fea39642523af2a602b5a6209326e554327d06b1bfa6f4f5c355e832c1e5b3672a6a5d94f69f635e4d5b01ab5732b1106a65e2c6b6ca47021a611b9e33
-
Filesize
7KB
MD5acceb59b1d686d6b818ab1417327c8ff
SHA189b69c84cd4d23f770c387a733260c3ec51d38e9
SHA2567209b2340798c430a691f31b5d4eee92f6cf0207f1c40781842bbb0a04a47a62
SHA512c1ba24ada6cbba8502de716013f239333c95af933b74b73334b99e8f13c46f3dfc39d4a4aac898a283bbd565566ae36650005e547041a14a201146d96b9f55c0
-
Filesize
20KB
MD59256018069e92083bbc86bd8deb4685a
SHA19aedeb72a9d0aacf12203ce0e5317a51221a325e
SHA256a213e7b6e2a316194e71869b59c5945695259330bcea3f912f0a36ed0607d423
SHA5126e7c1a9f64d1573789f7731d5697a4ddc40d066df55803f8b52cbac73fae406153ca4a184ea81ed45534ec4b285fdada236a99b48d370750ce4520e53576c7f1
-
Filesize
3.0MB
MD56ed47014c3bb259874d673fb3eaedc85
SHA1c9b29ba7e8a97729c46143cc59332d7a7e9c1ad8
SHA25658be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19
SHA5123bc462d21bc762f6eec3d23bb57e2baf532807ab8b46fab1fe38a841e5fde81ed446e5305a78ad0d513d85419e6ec8c4b54985da1d6b198acb793230aeecd93e
-
Filesize
90KB
MD578581e243e2b41b17452da8d0b5b2a48
SHA1eaefb59c31cf07e60a98af48c5348759586a61bb
SHA256f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
SHA512332098113ce3f75cb20dc6e09f0d7ba03f13f5e26512d9f3bee3042c51fbb01a5e4426c5e9a5308f7f805b084efc94c28fc9426ce73ab8dfee16ab39b3efe02a
-
Filesize
694KB
MD5a12c2040f6fddd34e7acb42f18dd6bdc
SHA1d7db49f1a9870a4f52e1f31812938fdea89e9444
SHA256bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1
SHA512fbe0970bcdfaa23af624daad9917a030d8f0b10d38d3e9c7808a9fbc02912ee9daed293dbdea87aa90dc74470bc9b89cb6f2fe002393ecda7b565307ffb7ec00
-
Filesize
105KB
MD5fb072e9f69afdb57179f59b512f828a4
SHA1fe71b70173e46ee4e3796db9139f77dc32d2f846
SHA25666d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383
SHA5129d157fece0dc18afe30097d9c4178ae147cc9d465a6f1d35778e1bff1efca4734dd096e95d35faea32da8d8b4560382338ba9c6c40f29047f1cc0954b27c64f8