Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-09-2024 01:00

General

  • Target

    8367ac8403f30e782e231927d7581b450a117eda0dfadcb9da2e2ce912bd397c.exe

  • Size

    1.7MB

  • MD5

    0925ca356d951d1895b206a920d31c4e

  • SHA1

    2f20b9bff2225af61405eb9b74d734ee1e357b3b

  • SHA256

    8367ac8403f30e782e231927d7581b450a117eda0dfadcb9da2e2ce912bd397c

  • SHA512

    e358024b0588188ba4c844b1025be93587f77e34e12d95a2fa33fd1541640e942fe5a70e7435e26147cc287f73de01dcbb36b35963fd79140f0b1f084eea82a4

  • SSDEEP

    24576:wOAZrvBmhIlh+/8laovyegbMBegVU5wR4OTiFmJhRjJ4iynnDrIH+1UtQTSk2HS6:wOG8hCsbM0gdf+mz3TAGZ/FS6

Malware Config

Extracted

Family

stealc

Botnet

rave

C2

http://185.215.113.103

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.41

Botnet

c7817d

C2

http://31.41.244.10

Attributes
  • install_dir

    0e8d0864aa

  • install_file

    svoutse.exe

  • strings_key

    5481b88a6ef75bcf21333988a4e47048

  • url_paths

    /Dem7kTu/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Stealc

    Stealc is an infostealer written in C++.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8367ac8403f30e782e231927d7581b450a117eda0dfadcb9da2e2ce912bd397c.exe
    "C:\Users\Admin\AppData\Local\Temp\8367ac8403f30e782e231927d7581b450a117eda0dfadcb9da2e2ce912bd397c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\IECGHJKKJD.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\ProgramData\IECGHJKKJD.exe
        "C:\ProgramData\IECGHJKKJD.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
          "C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4212
          • C:\Users\Admin\AppData\Roaming\1000026000\7c5e5052db.exe
            "C:\Users\Admin\AppData\Roaming\1000026000\7c5e5052db.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1224
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 1016
              6⤵
              • Program crash
              PID:2672
          • C:\Users\Admin\AppData\Local\Temp\1000030001\91e3f46a38.exe
            "C:\Users\Admin\AppData\Local\Temp\1000030001\91e3f46a38.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4780
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1252
              6⤵
              • Program crash
              PID:5832
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000035041\do.ps1"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4952
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2980
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xd0,0xd4,0x7ffa8bf1cc40,0x7ffa8bf1cc4c,0x7ffa8bf1cc58
                7⤵
                  PID:3052
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                6⤵
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1532
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8bf1cc40,0x7ffa8bf1cc4c,0x7ffa8bf1cc58
                  7⤵
                    PID:536
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:2
                    7⤵
                      PID:4380
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1332 /prefetch:3
                      7⤵
                        PID:1300
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2440 /prefetch:8
                        7⤵
                          PID:808
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
                          7⤵
                            PID:5484
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
                            7⤵
                              PID:5496
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4040,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4072 /prefetch:1
                              7⤵
                                PID:6208
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4644,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4712 /prefetch:8
                                7⤵
                                  PID:6380
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4820 /prefetch:8
                                  7⤵
                                  • Modifies registry class
                                  PID:6388
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5068,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5080 /prefetch:8
                                  7⤵
                                    PID:7376
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5268,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5272 /prefetch:8
                                    7⤵
                                      PID:7720
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5392,i,809634361129123124,14972161625557064388,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5420 /prefetch:8
                                      7⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2976
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com/account
                                    6⤵
                                    • Enumerates system info in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of WriteProcessMemory
                                    PID:396
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8bdd46f8,0x7ffa8bdd4708,0x7ffa8bdd4718
                                      7⤵
                                        PID:2460
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
                                        7⤵
                                          PID:2080
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
                                          7⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4196
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
                                          7⤵
                                            PID:2856
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                                            7⤵
                                              PID:5236
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                              7⤵
                                                PID:5280
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
                                                7⤵
                                                  PID:5912
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
                                                  7⤵
                                                    PID:6324
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17780694973375949677,17649039744703263304,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
                                                    7⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:7884
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                  6⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4252
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8bdd46f8,0x7ffa8bdd4708,0x7ffa8bdd4718
                                                    7⤵
                                                      PID:1260
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15310268428207305261,1862168405727989135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
                                                      7⤵
                                                        PID:5192
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15310268428207305261,1862168405727989135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
                                                        7⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5200
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                                      6⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2716
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
                                                        7⤵
                                                        • Checks processor information in registry
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1076
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1900 -prefMapHandle 1880 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d52d0295-bab2-4f23-9190-be7ccebd1145} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" gpu
                                                          8⤵
                                                            PID:3660
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b10b0b52-c7ee-4b0b-9a92-f2f34ac54445} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" socket
                                                            8⤵
                                                              PID:5292
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3252 -childID 1 -isForBrowser -prefsHandle 3244 -prefMapHandle 3240 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d23b49f-9064-4064-8b42-54bff6d90c2e} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" tab
                                                              8⤵
                                                                PID:5968
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3896 -childID 2 -isForBrowser -prefsHandle 3764 -prefMapHandle 3804 -prefsLen 22693 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf85d418-7d85-4b0b-a951-9d7df39bdc01} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" tab
                                                                8⤵
                                                                  PID:6348
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3644 -childID 3 -isForBrowser -prefsHandle 4424 -prefMapHandle 3764 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75aa0085-1d90-4f71-a0d1-b11f65756cdc} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" tab
                                                                  8⤵
                                                                    PID:6588
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5264 -prefMapHandle 5260 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc8eb703-4074-4ee2-9a31-f665a13a88da} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" utility
                                                                    8⤵
                                                                    • Checks processor information in registry
                                                                    PID:7340
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5764 -childID 4 -isForBrowser -prefsHandle 5788 -prefMapHandle 4720 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b214b0d-29ea-461e-85f9-ddbc418daff4} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" tab
                                                                    8⤵
                                                                      PID:3328
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 5 -isForBrowser -prefsHandle 5824 -prefMapHandle 5820 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec8bdd5e-17b7-4d04-98f4-1b1c4bb1d61c} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" tab
                                                                      8⤵
                                                                        PID:2136
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6056 -childID 6 -isForBrowser -prefsHandle 5968 -prefMapHandle 5816 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bffdf0e9-2e51-4b99-b109-bb823152e0bd} 1076 "\\.\pipe\gecko-crash-server-pipe.1076" tab
                                                                        8⤵
                                                                          PID:6344
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                      6⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4504
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd
                                                                        7⤵
                                                                        • Checks processor information in registry
                                                                        PID:1720
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1224 -ip 1224
                                                            1⤵
                                                              PID:4448
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:5736
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:5508
                                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                  1⤵
                                                                    PID:6244
                                                                  • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                    1⤵
                                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                    • Checks BIOS information in registry
                                                                    • Executes dropped EXE
                                                                    • Identifies Wine through registry keys
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:7296
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4780 -ip 4780
                                                                    1⤵
                                                                      PID:2220
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                      1⤵
                                                                        PID:7784
                                                                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                        1⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:7588
                                                                      • C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\0e8d0864aa\svoutse.exe
                                                                        1⤵
                                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                        • Checks BIOS information in registry
                                                                        • Executes dropped EXE
                                                                        • Identifies Wine through registry keys
                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3996

                                                                      Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      • C:\ProgramData\IECGHJKKJD.exe

                                                                        Filesize

                                                                        1.8MB

                                                                        MD5

                                                                        fb715bbfab832a6a7b4e05fc94a74b88

                                                                        SHA1

                                                                        b2f10e8bcd6e86d52d2e40d45fa79801e45cc4bc

                                                                        SHA256

                                                                        9b79444f799b4643e0332ee52281b406639cc9b7e63c61f7796d1fcfa56c5377

                                                                        SHA512

                                                                        448ff097de5c6bb92ed9fa4e09f303408729f14b7156bcf4fcb2d6fa8b5859aa04cbbaeb8791e9cbad6ab437cb5e86e582b715a07a13142215341a8ce8c3f9d5

                                                                      • C:\ProgramData\mozglue.dll

                                                                        Filesize

                                                                        593KB

                                                                        MD5

                                                                        c8fd9be83bc728cc04beffafc2907fe9

                                                                        SHA1

                                                                        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                                        SHA256

                                                                        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                                        SHA512

                                                                        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                                      • C:\ProgramData\nss3.dll

                                                                        Filesize

                                                                        2.0MB

                                                                        MD5

                                                                        1cc453cdf74f31e4d913ff9c10acdde2

                                                                        SHA1

                                                                        6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                                        SHA256

                                                                        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                                        SHA512

                                                                        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        40B

                                                                        MD5

                                                                        efc82f8314de2fb0909127cebb38a019

                                                                        SHA1

                                                                        ffeb52cdf0bffa888270847d4981cc96ba448c14

                                                                        SHA256

                                                                        9836d53d4914279fb42e48acea940dc78d94b2ba4866e0731a528c65ff131d2a

                                                                        SHA512

                                                                        89d234d0dbecccda14e5fadb343a7b80a4ce464e270d1e17488b66bf707da13c0f0de30ce9f4a20746c5951c31fe776e9d618712fa6a842749555dd1cc2b0866

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                        Filesize

                                                                        649B

                                                                        MD5

                                                                        364999e28487945837178d80d41dad56

                                                                        SHA1

                                                                        ec3b5eb7e13a38672968f41e8f1fcb3bf564542c

                                                                        SHA256

                                                                        1e2aabae7cb9ce6d5a9815441bb7778d8020f045f90ebd2b411f3f8298748c3c

                                                                        SHA512

                                                                        52a4ca9c593e69c85716fd741478eb39a6c25b0949f8a21a33975f15f9e07a41fb0725e4efc2d6a46be4e5ebcdaab24ce77969cba3d99df12374f6dc7feee566

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        552B

                                                                        MD5

                                                                        207b1d0fe3c6370eb98a6089ab90c850

                                                                        SHA1

                                                                        0d8c4be9d48ed0730db6de263ec8942a0e6442da

                                                                        SHA256

                                                                        a12e132d334f4760c298782774755868975fca4a2af2b03c1e5a4fb8b56d5eeb

                                                                        SHA512

                                                                        72fc8bcaaf7cd02eceb4061da20b564174b37029573b694215d45f84b01247307fe1ead3319cf7e55d25315de0e233683b7d88bf12a56fc0b52fcfc72a72d1b4

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        43f5da5a178dcefcd4a0bf26f6896b01

                                                                        SHA1

                                                                        f2475ca6d50e1e8421af2c1cfecc2033dc958da5

                                                                        SHA256

                                                                        be7d083fed1a85c9c788685b7a05904e3ee732c871e52143d0ed47c287f5b487

                                                                        SHA512

                                                                        b181a67ea14a83ceda0f9f70ae8299d0c83bc035739847f6288bf4a404106945f7de83e8ac91c293639002d1710e4e4a089fa2133dbab50c37e9e1a3e3c6f645

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                        Filesize

                                                                        2B

                                                                        MD5

                                                                        d751713988987e9331980363e24189ce

                                                                        SHA1

                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                        SHA256

                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                        SHA512

                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                        Filesize

                                                                        356B

                                                                        MD5

                                                                        632f9e3c58cd9b6f8d6a2df6706d3bbc

                                                                        SHA1

                                                                        f091274855e693013669ce1a91811d7713edc069

                                                                        SHA256

                                                                        89d9cf828d3872c0ac757cd6221f53d969c09d44c91a214b14ff746dc064bbba

                                                                        SHA512

                                                                        4d52b891ac1321111f5945b8419b3391cdeb214b7f89259f6e327a69a245b7990a79c052471e8fff377f17facb5ba1b43ab60bbfd8d213a39072a11ec006705b

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        0a9b9bd632728cd3f4f2502611d913d3

                                                                        SHA1

                                                                        516a62d53b41f8b56c64f699973c6205b1694f17

                                                                        SHA256

                                                                        dae10fddae522647597971456f9bc3c9e82a7fb7c10f07af58ab4254642d6833

                                                                        SHA512

                                                                        f3d311b9bd3cf10a35f79fde92b94f307b47bca89fb5e8deda56f5a0cc36eb6d53f90ac2f6f934214921048d2ea94df6a5a38c29e453378b960f3e896b59c68d

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        e9bdcc3612ee123e49d4485bf6fcee3a

                                                                        SHA1

                                                                        c9db55d038a8adadf2ab517b7f7f26b5dbf1d99e

                                                                        SHA256

                                                                        2542ae5f4a44786089ed16bfc6ac01e3c08a02bdcb837f78e3cadc68d3d687e8

                                                                        SHA512

                                                                        7e5fbb330b0b1a38254013e1ed40df72636f6a97357028413d1d34a2727ab707e20070f6d3a09a8877968899a49567e33c6f42acbf66d150f81efbf62852522e

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        b4141bcf6020481ef77becdf3a09ceae

                                                                        SHA1

                                                                        ffaf0eb9502da089dadee7c34bfcad615c2bd2d2

                                                                        SHA256

                                                                        9e88b1dfd3c63d1baa0df510b108431200b4d7a342c121893044ce2e4c3e1e7a

                                                                        SHA512

                                                                        1d7673c6898a7a360623de1218a319217d10773ed075b7782b45317cc8de07f4256e2868055f80e057485ee710bc1f2e3e0434fdec0281cc5f1c4413faded2d9

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        f72a2ab475657cbb44e8b732f022e09c

                                                                        SHA1

                                                                        f426a58e711c8c4571fd6a6c2e368117ce8f548e

                                                                        SHA256

                                                                        b29a158f705a4173f431991489167141051f843b3678ec7823df9a617e91ff64

                                                                        SHA512

                                                                        f5809d51520f807450bab2310d806e5e8089324399ea4d260c0b86d3c5054033283f20b2bcb246dc568f94eb915e6cb87ca8004dd6726987a86c5c17c8e705a0

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        af44340a2462d180591a16569dcbd502

                                                                        SHA1

                                                                        3185233426b5556edda421925c217619456c27d4

                                                                        SHA256

                                                                        fa2a466172338aaf91d14a7c4b56b03762b02ecf9f690c685b9de794e21c9128

                                                                        SHA512

                                                                        e9d7530d22a5dc4426440d4de626852e5b435dce699344c45e60bc9a55735ed417a37898364bcb1adace366045b9f1e18ab710a337a96da3d343bb51a635b5f1

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        9KB

                                                                        MD5

                                                                        1eac98d3ca6b9593c9e793a5f0708617

                                                                        SHA1

                                                                        1130fb897fe01abbb75c678d1246218ec6a3e079

                                                                        SHA256

                                                                        6267d8a8b419b03dffc4c41f2714188b813e8baf8c9914775c91dc20ab0b5dfe

                                                                        SHA512

                                                                        1c51207231ae28cf68ec8d1a6e32706d9fbb8ba6883feaf371defda39c2b6cc3b4469ec7e945926daedcbf70322a6776fc82ce05fadf81fb1ebf8592783456e3

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        94fbab9ef2b28691e25a5990f5bc900d

                                                                        SHA1

                                                                        0a739cea5247b3a860bd93d01111c8331a3095fe

                                                                        SHA256

                                                                        b5ce63687da887cdd87043bcdfc7d6f2dcdffb5bfd918836d595c880448c6a95

                                                                        SHA512

                                                                        361a27c484cd8b3cb143be38e6475b2fa482d0b1df419bd1762b0fc3d8492e97d7f372bbc38ee0b2e768fed65e54d7312f0560bba8cb3e6928c090f9a96aec17

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        5c5f910b83941c3ae8af1d3aa3c79d59

                                                                        SHA1

                                                                        bae917688d934ec5439525192067b7107ee8a03a

                                                                        SHA256

                                                                        46f5863c00435308c14b7a88d393eda1f5f6314984665989c185286da971c7ff

                                                                        SHA512

                                                                        4f33307befdb5d56eb297bff00abc337c55da8220a9a13740c6f77877210730905adbf2b9ba20e0715800f0d3736bec567611356975bfc80eda56560f983ce32

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                        Filesize

                                                                        15KB

                                                                        MD5

                                                                        ce925e597b73359a46101ad8598c6db7

                                                                        SHA1

                                                                        ec8a9b9b93e4cd7a8269b86150447f67c225ada8

                                                                        SHA256

                                                                        721dc845524a6aa6bd130fdf08bbe29e01b025db09b7e6125105f6f0ba0ec27c

                                                                        SHA512

                                                                        8fdac52df264ef8d822ea169a150cf41f22e7a557eece2f1d877731dbfa110de6ebbc7fabfd66afe8f7312b25fc53213c33897718e36827966e5f3222762ec77

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                        Filesize

                                                                        205KB

                                                                        MD5

                                                                        e5a8bee3152c3f7bf083d35e7d11c6f3

                                                                        SHA1

                                                                        e33b5e50ac40ad887600e081aa068eb1c9873f81

                                                                        SHA256

                                                                        9dd03f8873e4d7f630337594d6a036063257f8375318013888d1320b049bf2ef

                                                                        SHA512

                                                                        67db19ab6724eec652fd552c06ee65797bc69cc6396ffeb2ee5342182ae5da44990102c74b912f737fa434cf5fedc3594dd1cb2a3adc75b84531bac72a8f54e8

                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                        Filesize

                                                                        205KB

                                                                        MD5

                                                                        0115eae0548dfc236e5629ba4d392ea5

                                                                        SHA1

                                                                        558100197b36de0510b1ef5ffa5ce15307bd3ce3

                                                                        SHA256

                                                                        ad3e505377cf2910d94b851880d58b5c79dd6862e06d3661e0091024e0afe6f2

                                                                        SHA512

                                                                        69303e0e2bae5105bb335773c4217e505a868d4fe544db826c808244ef9b12d85706091e1b52f338f2cda6875956a621dbff239ab936934b6cdf57ff4121e583

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        e15f9acde9d56006be268b4025f94b5b

                                                                        SHA1

                                                                        5d36b646b34f0a1d08b6020f12e548db96865906

                                                                        SHA256

                                                                        045480199f3befc5d2eee18f84e92cc5bf8881b76ac168085a987878da798e0c

                                                                        SHA512

                                                                        22d43f812391c9fafde0a4e247212e491765e8f049eb56d692f248623b7a52044ceab8e6977675c343d502b460666bd72a4ea970f9aaa7a6b8a6c3a880bcc255

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                        Filesize

                                                                        152B

                                                                        MD5

                                                                        6837505dae817f02bbb549d3910f76ec

                                                                        SHA1

                                                                        4bead1243a3ed4ba876f30031d11b7fcd4052b84

                                                                        SHA256

                                                                        997f7c6bb1805cb785d5c0ce131c8cb2362e6dc77efb38c3980f69b7a789a649

                                                                        SHA512

                                                                        4382a76e27e70b6ecc05c14e9a1b915e36ca661cb868042b28d59a7d807ae1ba069aa0e734648225dee2b6dc33626f58ee24df1cc451217fa093f46d5df616d4

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                        Filesize

                                                                        51KB

                                                                        MD5

                                                                        f61f0d4d0f968d5bba39a84c76277e1a

                                                                        SHA1

                                                                        aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

                                                                        SHA256

                                                                        57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

                                                                        SHA512

                                                                        6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                        Filesize

                                                                        528B

                                                                        MD5

                                                                        34ba4a6f7d4c380966b4a9fc8b76fc34

                                                                        SHA1

                                                                        110dbfa087f3d2959dac504c7fbe0095809eece8

                                                                        SHA256

                                                                        ed2c1b5e74958e45408862f3f7d46f2788968c240ecefcc28faf913caaa9b74e

                                                                        SHA512

                                                                        a2880ec025b6443ce462769289d506691a94e9cf51af7efe77331e149fe940cb51c0711c952513a36be1d07fe0073828dbebdcee3258dba164af90990e147e0c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        3af676b5dc8d8dafa39acf9653f1d9a0

                                                                        SHA1

                                                                        75b3369ddba8d4aa5a36dea344b599cb48e921d5

                                                                        SHA256

                                                                        a3da23b25f3d8d80c76c5429d63a017d59a7fcdebd167d62ec8d28d76289b935

                                                                        SHA512

                                                                        206b38f50e49785a46bd3b283c4be5d225932993106d3db8c5cd375eb46137097db2bd8df75139686bfe520b692fbaa4be0966cb9fdfb3378b31cfceb29ce94c

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        f258638e65505fe54d421e96a4c7c0c1

                                                                        SHA1

                                                                        af2ea8f76ca8471bd6515c6ff5a3e90a22b8c356

                                                                        SHA256

                                                                        571c635aa82a1776db89d1f24d1c62a532d3d63c107905792ea37fe73ad30d7f

                                                                        SHA512

                                                                        a9effb111d17f73ec4a1c97fbae64508907cb43b051084388ea6b53fe4d62c6fac6c7026177ddde20e3ad35e917e736d63925b29ed07d9fec317f8ceccb39706

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        055c250422166df3b351a06bc1f4a795

                                                                        SHA1

                                                                        4efdb244dfc7cbc68dd9d2942a357e507f0fcdf5

                                                                        SHA256

                                                                        101193166e670507ada57b6973177118385e5c0a28ed44b52cd17b14caf3f580

                                                                        SHA512

                                                                        0b38ea1c300e06da0d4ffb46ed76eaf6c00d2a1d76c05137f847583fa27a7a54d5bf69078e49395e16cf414a1e8c0c1be916ed2404a7282056f08b8276c4822f

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                        Filesize

                                                                        24KB

                                                                        MD5

                                                                        e311e8070a5db17b6cab425cdb01bd27

                                                                        SHA1

                                                                        ac533db7fa0902f34d02662fd029facbf4b8e8c6

                                                                        SHA256

                                                                        b9aaa4c71488c3a8769cee7cf502ab93813fd6df60ff2172ba8cb7e1dec86532

                                                                        SHA512

                                                                        87accdca84a2b2042e2c12381cd1bc0fb2d74bbb0c6a4d18f444212803ebc0b7184317df7f5fb3eac722d5d43d942dd62ee1d760f0b3fd18911df5bd04fa31c6

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        10KB

                                                                        MD5

                                                                        801b5bdaac1aa2ca09d90dd4a39e4660

                                                                        SHA1

                                                                        8676b8b826d85b2d515537e65eeb375a95241954

                                                                        SHA256

                                                                        f582c183feadc16628dc91117aad336d66f48a7e2d7f584b78f6e20accc4d7db

                                                                        SHA512

                                                                        b0f6f3b8a9d1f3e87d77556ad94b04c97f400dfa107e85f12e6eb0b8a3a72cbc63fe19b210e5b33e434a37237489d28accc112abacd7c2e8fffe8581136b26b5

                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                        Filesize

                                                                        4KB

                                                                        MD5

                                                                        4e3a43dae86f3c38b2cb050e031648f7

                                                                        SHA1

                                                                        533574a4e6f3a634b70aef8cebe568aca8d48423

                                                                        SHA256

                                                                        726eaa3e1804f7b2058fcd4f619db3a434ca899488dc00379b4cb7517d6e5081

                                                                        SHA512

                                                                        8ecdba98d797783df131860e0617511c7af44186e086f7b1f04274331a4cf06b4fb17b96af20cd019dcc9343dd7352bc0b027d669a8014491395a52fc8556fb3

                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json

                                                                        Filesize

                                                                        26KB

                                                                        MD5

                                                                        a770d4c388f49b455301382166ccb629

                                                                        SHA1

                                                                        497a71f8e4908bbb75afd8ffdea9f21eac965cab

                                                                        SHA256

                                                                        7d8c6f27fda8193e3dfe8951687b6a8fcd2e35a035f0e8c520b0f51f1b3acd22

                                                                        SHA512

                                                                        262a86312570938acd1c2ceef7e1244ed31c72a15634c8e1dd00c27ca270bac349b812d831fb881feeb1d54fc0ab4db9ec1f743643f86861286a7a731c373528

                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\cache2\entries\3F6BAE390F7FB4267066C23DBD35348B57989359

                                                                        Filesize

                                                                        47KB

                                                                        MD5

                                                                        b2b522f6b3b432ab8535e1717d971abf

                                                                        SHA1

                                                                        b32c5a711f5453888c50864e7826c73df023221b

                                                                        SHA256

                                                                        488a3cd199f4290b015a416da4bf89a8acfd84e7e0ef7c3f85e523e37731edf3

                                                                        SHA512

                                                                        ca2363299b2b7f9410a2de668ffe28125a7ddfcea6319df3989b278b07ab976315fe86e953c7a1bdea0f3aa1002a0ae6991038d4658ee031448b9cea196affb2

                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                                        Filesize

                                                                        13KB

                                                                        MD5

                                                                        c9b4ae08ee20d327f1ac1abc08d5f4ec

                                                                        SHA1

                                                                        1c4a6f9f62ac5fc090812ddea11ee774f785cd7f

                                                                        SHA256

                                                                        626185982a14d23a1afed373b3e801890e3ebbc14590ad21d023db3c87f5e6be

                                                                        SHA512

                                                                        db2e86f69ab31bc6ce7db35e099bd83fae29403167b759a6e3f31e637c8e1a9a4976b641910eb1a5a8b4e30d9b878f98d38689752fca25dab4ca88a31fc42780

                                                                      • C:\Users\Admin\AppData\Local\Temp\1000035041\do.ps1

                                                                        Filesize

                                                                        3KB

                                                                        MD5

                                                                        1f5ac0c26ba396b7af106e48db46ebcd

                                                                        SHA1

                                                                        5b504936cf427af26479bb1c0ec275a2fc77270a

                                                                        SHA256

                                                                        280d4f5ce7d8f2a3551ab509ad321971ff8eda76dad33ffae5b8961070209cef

                                                                        SHA512

                                                                        65eed3f167c83f53b7e2474dd5b2ab58c7dc7ddedbe89fafc016cd1441dfd02e5c92de3dfb9e2f0ca98b8f438779868999e3212ef64210fde27072e7ad64f68e

                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y0fihtdj.jat.ps1

                                                                        Filesize

                                                                        60B

                                                                        MD5

                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                        SHA1

                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                        SHA256

                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                        SHA512

                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                        Filesize

                                                                        479KB

                                                                        MD5

                                                                        09372174e83dbbf696ee732fd2e875bb

                                                                        SHA1

                                                                        ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                        SHA256

                                                                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                        SHA512

                                                                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                        Filesize

                                                                        13.8MB

                                                                        MD5

                                                                        0a8747a2ac9ac08ae9508f36c6d75692

                                                                        SHA1

                                                                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                        SHA256

                                                                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                        SHA512

                                                                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                      • C:\Users\Admin\AppData\Roaming\1000026000\7c5e5052db.exe

                                                                        Filesize

                                                                        389KB

                                                                        MD5

                                                                        f47cc7dc355ae01926f6065316c3bd68

                                                                        SHA1

                                                                        6b575930185f216e4fa5116fdcc8906eb9f53af9

                                                                        SHA256

                                                                        25741e3975370f8b2c77513a0941ca4263a83ec08e1203c9dd7cfd5c18474794

                                                                        SHA512

                                                                        cf076a077130b8dd48f3e27a6aaba411a6c8833ab8b926c99fc3fb66130694db1ce668103c44aba6196705a9722b68da16287ea8a63ffed250bcf92bba68154e

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                                        Filesize

                                                                        6KB

                                                                        MD5

                                                                        5b43a2c0016a85e850ff5adfcf8ba2d2

                                                                        SHA1

                                                                        2f9d200ad92b8d53002f196d7f9080f052219d45

                                                                        SHA256

                                                                        b4de4759c20b38a04a60cb424530fb73a029d3895b2356c90ef242f337bdb95f

                                                                        SHA512

                                                                        025a3ce018c6da925c43fc1c25513d0fb36b0b21d69f23e11ae59980dc98eff36d7e13118964f84dd42ff2b0965148fc6bf6da20bb37e5ef2cd7e1e96da6b2bf

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                                        Filesize

                                                                        25KB

                                                                        MD5

                                                                        717acb53dad6f8532bb7e2a02907d4d5

                                                                        SHA1

                                                                        ef2270f51efc97ed3c7cd7d58f4d74ddb4d33a84

                                                                        SHA256

                                                                        aa799dea3c7579393214d76d2137c2e98419120c4aa9db10038e6b8ec648d5a7

                                                                        SHA512

                                                                        99eada9dc75a34760af637b5a290995a5c7aff0962477de346e64b2e3aa87ecc0d9268968b75868b51c7033f6875ace08ad46067585a9e9060659cb26519c0e0

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                                        Filesize

                                                                        8KB

                                                                        MD5

                                                                        bfa66d74ed2f567212c77f28cf8e8394

                                                                        SHA1

                                                                        9b26af833340e655de076ccbb537ee4e19b9ad01

                                                                        SHA256

                                                                        bba4c5ff6d581c9802d1cdeacea308e34cb1090b0786487cf51eb0863e13c494

                                                                        SHA512

                                                                        6b1023a544a58cb4892a4d0eb1326c4528f08fbcf075e649d9711115a0085d08f47e2e7d4e646c5d6a4a038ae5a11790cc8307150e60e2d1a9bc58ab32372b28

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                                        Filesize

                                                                        16KB

                                                                        MD5

                                                                        e638bb5fd9ffb9a0ef965eb218097c9c

                                                                        SHA1

                                                                        936e9480aeba72e20fec563dd9e4a32112c74f7c

                                                                        SHA256

                                                                        a40fe0d46a62c00a7b2fa91a60388f0f5a3c2217bfb46503d27dba13e14bfce1

                                                                        SHA512

                                                                        394efd52ab46593db8b55107f85fe8d3a6912a5e60a46684747aa38dbf243e44feeccb7526344812289e665ddcd93581a7a8a7a58a11b50a0a7da40ff8b83a0d

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin

                                                                        Filesize

                                                                        23KB

                                                                        MD5

                                                                        fae39676d769c1a2258cdf990719ecc8

                                                                        SHA1

                                                                        46094b516c62026ebd77ed5f8636285e4ece1d43

                                                                        SHA256

                                                                        c27093332cc5755314cbf92929d9b519f6a85daf0f5d9fa64084739208da8f46

                                                                        SHA512

                                                                        a3be076171af2b33ac2cae8436cb49be3ef6f95dd21636df47cae311db7cc04ef997951c48bb600d5d2fd163dcc62660ac99415b59e8bad1e3d1d37d9d530831

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                                                                        Filesize

                                                                        22KB

                                                                        MD5

                                                                        66b98eb332cfa1e3f236d12904be2a91

                                                                        SHA1

                                                                        2b1582ad6e65641c95bc4bde9b58d9cdae2d4024

                                                                        SHA256

                                                                        c7c4d2ca9bcebbb583a10069c29fb6174ca51e863dce3aa3caae735cb51a324a

                                                                        SHA512

                                                                        ac99dd588db3b9a8fc30aff56ab174391208f4711190d91c365468bc8cddc77f76ce4839ca90ac31aadf84172adff82ff4c5c6f8418b8c1f3eb128eaaa9970ef

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                                                                        Filesize

                                                                        22KB

                                                                        MD5

                                                                        5fe501ef26f76c31d138137b24b7ad73

                                                                        SHA1

                                                                        3e6a719992b7ca079a71008e407795c3d380158d

                                                                        SHA256

                                                                        efe6e1592bb5d8058e4d212bfd0ff18a4eef1b647b8900f0defcd3a10915644c

                                                                        SHA512

                                                                        a955c98810b55c2bc6c033455f48268cd28f5f13ea8dd1d5936239de9c4b91e08b2daf07533d2d6603fbae478f576a37e5d480636820eb461906de9c1d1022df

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                                                                        Filesize

                                                                        21KB

                                                                        MD5

                                                                        13110a9118b2eca291cd60c6e708aeff

                                                                        SHA1

                                                                        2486d3be2ef789e5bca275a316d963220ce21be3

                                                                        SHA256

                                                                        e21de1f7d0b33f3c2019e4067ec7a0823c4828f77a50266f92a5d5bcafc13d38

                                                                        SHA512

                                                                        ef3288cb5b07e03ffa0c60b2ef2a05ed04927ac8e4bc86daf3dfc2893c37396aa8749cccf0b6ebfc9b4fc63bfd287e1b75d6694d65000d8c786e8306bbfe5c74

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                                                                        Filesize

                                                                        24KB

                                                                        MD5

                                                                        90ad06a957a94602b252a6e2934eccb9

                                                                        SHA1

                                                                        4364d46afd73f391eb3e67c8fb60ee647d56f44c

                                                                        SHA256

                                                                        c477cdd75f6cec4d4716505ceb0f359baf57afecef5217eb9f40fb04557651fd

                                                                        SHA512

                                                                        24273077b4e522fdcd0375a7c83479d66bce9bd9eab8c1c5d3c7b7f9925bf2ae9bd22222023619976e5391d79d1a43e7c795bced4abe2eccb753fcb7e0a65d95

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp

                                                                        Filesize

                                                                        25KB

                                                                        MD5

                                                                        251b38b3be1f8253c9733e692e01bdfb

                                                                        SHA1

                                                                        5e3056a9fca2c8504cccd3ac0e16b56530f77d8f

                                                                        SHA256

                                                                        16e836304b955d39773027cf20c2a2f4d4c730dc58ee1fb7378697bc274e4b16

                                                                        SHA512

                                                                        3cc726967572a436b6da65eab857fc8908db68033d22ca0ada662c5027310a0efbf45c1defea3b40a7b63396c7ee29676f32fc727ad3ae23804f78c61117dbed

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\cf3229fb-39c0-4d6f-9df5-876077385d5f

                                                                        Filesize

                                                                        659B

                                                                        MD5

                                                                        6c4c2590c3f41615f7759bfffff1d40f

                                                                        SHA1

                                                                        d9dd7289784f6e65adc4887dcc557331ae877106

                                                                        SHA256

                                                                        3b7472f1d20b068ef0654e1715120bb69f7fad670a060a7495050136a721f029

                                                                        SHA512

                                                                        c2f06cc02e53bd1ff62ec02828f4ddffc2e74aaaf3015605add02d13ea08589ac469bbd84d752900fc4eb72d270e3a532964572a1b0de53362c43d747d0b6f95

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\ec9649fb-e954-4ff7-9fa9-808dcda6a16c

                                                                        Filesize

                                                                        982B

                                                                        MD5

                                                                        83665319a16e542cf482573fcd7b2171

                                                                        SHA1

                                                                        e7493ce5c9970698bd8ea9dca7b1ebda4c7b1c4f

                                                                        SHA256

                                                                        8f2c1983a9a7843a85154510241c7ad1bb34db43a58f88da445c63634002fb81

                                                                        SHA512

                                                                        40980c178bc3ae9ab6287b08d5e38158eb5cd43a0a71c06b5009090f80d513d297efbe16950c83b1e50bf5feda5747da6173e041a2eb8edcca33823881bb1758

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                                        Filesize

                                                                        1.1MB

                                                                        MD5

                                                                        842039753bf41fa5e11b3a1383061a87

                                                                        SHA1

                                                                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                        SHA256

                                                                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                        SHA512

                                                                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                                        Filesize

                                                                        116B

                                                                        MD5

                                                                        2a461e9eb87fd1955cea740a3444ee7a

                                                                        SHA1

                                                                        b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                        SHA256

                                                                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                        SHA512

                                                                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                                        Filesize

                                                                        372B

                                                                        MD5

                                                                        bf957ad58b55f64219ab3f793e374316

                                                                        SHA1

                                                                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                        SHA256

                                                                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                        SHA512

                                                                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                                        Filesize

                                                                        17.8MB

                                                                        MD5

                                                                        daf7ef3acccab478aaa7d6dc1c60f865

                                                                        SHA1

                                                                        f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                        SHA256

                                                                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                        SHA512

                                                                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        fbdf035ff753d3e58dd6ea8dfc443842

                                                                        SHA1

                                                                        ead88b3dbfbe1a17cfce7f67987778dd36165933

                                                                        SHA256

                                                                        cdeedfff5d499195de0fffefafe3db49a7a62e9c0d5049d9c88a8bdf1e41f30e

                                                                        SHA512

                                                                        c84e0e151453673c20fcf2039b15d93f34d25f877c140d1bf522c53534f50cd066c57f7df66e5ff7427194c33b619cdb60211e246fdb1f75a21619bdbdee869e

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

                                                                        Filesize

                                                                        12KB

                                                                        MD5

                                                                        cbea2f70ba85e2c7455816ba190589a2

                                                                        SHA1

                                                                        553f2b5aca64d8aaeb1a09d415b676633a4eca8e

                                                                        SHA256

                                                                        da113b5d42ca33355e558f031da12200de58ac4843e0ece77a7ca11ceb500d09

                                                                        SHA512

                                                                        a6da7ca971aa9da7166f1db17c0104dac1445ce973a6a06b82b88ef642c684a90c3e7a83719fea47b5131b9b74058040be524afbc5b8542b5e01d2af21244df2

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs-1.js

                                                                        Filesize

                                                                        15KB

                                                                        MD5

                                                                        b4f54c5e53f9ed00141654970b81557e

                                                                        SHA1

                                                                        256578d31c96a4e8624dbab61ae46bb2571e18b4

                                                                        SHA256

                                                                        980567361a029f25052123789b7b34ce1a4d8739790dad08ae4da2643a75f1fd

                                                                        SHA512

                                                                        315f3b538c24afb9cf80dfcf79eeaafc83b57741de11d04ab66e2cb27a678d2d99fbe41d6c7758e5cce862fcf29e86a8b9b0c0c3ec9e179e48804f1ab8274112

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

                                                                        Filesize

                                                                        15KB

                                                                        MD5

                                                                        85850aa243c5e4ebb4fbb50cc505f986

                                                                        SHA1

                                                                        04ccc209a3e63334b5f4abecb919080910a509aa

                                                                        SHA256

                                                                        f7d4c0c53aff83bac47f827085d8fc88f1b0c7386edefaeba9fa2bdbe1500075

                                                                        SHA512

                                                                        0418a96e01c0e8d2627826d2461c09175359fe84bce0cd1d6470f3f40b59cc352b674b8c0439448aebc6d097f17f62cd13c8461169b4c402c863fdbdbf5daa12

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        869f1843fff8907f785aaee87dbe2829

                                                                        SHA1

                                                                        35770d6875a62f533b2a4c5e7fd6afa02a039b16

                                                                        SHA256

                                                                        153a44a312a0e919a258af4abdd64724ee72c86d904e32f9cb57e2ad2c2a900e

                                                                        SHA512

                                                                        974ab84751b0fcb8ad37c501533451ba26c5e16cc92d4e5c6c4d683ccbb2f0e37821f946d3f439258049f2e3805ef7446dd88d7d57ecae42959d3b21afab5133

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\prefs.js

                                                                        Filesize

                                                                        11KB

                                                                        MD5

                                                                        fb4721712e7606ec31f2209f891bd6d7

                                                                        SHA1

                                                                        2d64f969dc4cbc9e7267c70d842b1a5f4e631f7d

                                                                        SHA256

                                                                        3ac052840b6628a1c96d49fd87e0fb96b4cc8aabf26e2212ebc9d94674cea3a4

                                                                        SHA512

                                                                        019f1a9b7cf05e5e44e23a9847e0a1ba355a499bc5bc1bc2e293a338d44cbbae4161bc9270f38919a4085c4dadc23704aa350cbf6aeb8ec5f046379ceffbfd67

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

                                                                        Filesize

                                                                        1KB

                                                                        MD5

                                                                        c7a52c224c2414f6c2bfa66a4780f47c

                                                                        SHA1

                                                                        fe96325df1e6e1c66f46e5945bc72db79c5356f0

                                                                        SHA256

                                                                        ef581d9197dbeb96e935adc163370564f3efd14a279c691df7ffb73fc782062a

                                                                        SHA512

                                                                        69f7e4c90d80959ec23e74e9a22a177b51fd09975e5678468d550d15591d8015e5227eb35099a682df38edd9b19039483df1b9f8c6a41fa89fa08c20b9d6519a

                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\sessionstore-backups\recovery.baklz4

                                                                        Filesize

                                                                        5KB

                                                                        MD5

                                                                        8b8763f8a407beb8fa1888f0c0294f85

                                                                        SHA1

                                                                        26566fb387730fa829edbb153d3e517c533a90fe

                                                                        SHA256

                                                                        3dccfe43677a8034ae94f49ccf309806fb5582d5d727db3155c10aad3428aa3e

                                                                        SHA512

                                                                        fad53ede334bb272ce83a49e5c158696ed92e0f4ba53cb6b0c6ecf375a0a2ea2776ec5b00f1caf78a8cc9d4381605f7c6f8b99610743451539cdc75c789cf539

                                                                      • \??\pipe\crashpad_1532_XGJHCEIOFKBICQTX

                                                                        MD5

                                                                        d41d8cd98f00b204e9800998ecf8427e

                                                                        SHA1

                                                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                        SHA256

                                                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                        SHA512

                                                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      • memory/1224-145-0x0000000000400000-0x000000000247A000-memory.dmp

                                                                        Filesize

                                                                        32.5MB

                                                                      • memory/2244-86-0x0000000000210000-0x00000000006DF000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/2244-85-0x0000000000210000-0x00000000006DF000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/2244-102-0x0000000000210000-0x00000000006DF000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/2244-89-0x0000000000210000-0x00000000006DF000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/2244-87-0x0000000000210000-0x00000000006DF000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/3996-3106-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3005-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-918-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3055-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3023-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3066-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3077-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-2158-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3056-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3107-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-518-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-590-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-1377-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-3076-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-796-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4212-103-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/4312-60-0x0000000000690000-0x0000000000CF6000-memory.dmp

                                                                        Filesize

                                                                        6.4MB

                                                                      • memory/4312-0-0x0000000000690000-0x0000000000CF6000-memory.dmp

                                                                        Filesize

                                                                        6.4MB

                                                                      • memory/4312-1-0x0000000077B34000-0x0000000077B36000-memory.dmp

                                                                        Filesize

                                                                        8KB

                                                                      • memory/4312-2-0x0000000000691000-0x00000000006A5000-memory.dmp

                                                                        Filesize

                                                                        80KB

                                                                      • memory/4312-3-0x0000000000690000-0x0000000000CF6000-memory.dmp

                                                                        Filesize

                                                                        6.4MB

                                                                      • memory/4312-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                        Filesize

                                                                        972KB

                                                                      • memory/4312-90-0x0000000000690000-0x0000000000CF6000-memory.dmp

                                                                        Filesize

                                                                        6.4MB

                                                                      • memory/4312-52-0x0000000000690000-0x0000000000CF6000-memory.dmp

                                                                        Filesize

                                                                        6.4MB

                                                                      • memory/4312-53-0x0000000000690000-0x0000000000CF6000-memory.dmp

                                                                        Filesize

                                                                        6.4MB

                                                                      • memory/4780-627-0x0000000000400000-0x000000000247A000-memory.dmp

                                                                        Filesize

                                                                        32.5MB

                                                                      • memory/4952-158-0x00000000062C0000-0x0000000006614000-memory.dmp

                                                                        Filesize

                                                                        3.3MB

                                                                      • memory/4952-165-0x0000000008000000-0x00000000085A4000-memory.dmp

                                                                        Filesize

                                                                        5.6MB

                                                                      • memory/4952-142-0x0000000005350000-0x0000000005386000-memory.dmp

                                                                        Filesize

                                                                        216KB

                                                                      • memory/4952-143-0x00000000059C0000-0x0000000005FE8000-memory.dmp

                                                                        Filesize

                                                                        6.2MB

                                                                      • memory/4952-159-0x00000000068B0000-0x00000000068CE000-memory.dmp

                                                                        Filesize

                                                                        120KB

                                                                      • memory/4952-147-0x00000000061E0000-0x0000000006246000-memory.dmp

                                                                        Filesize

                                                                        408KB

                                                                      • memory/4952-164-0x0000000006E90000-0x0000000006EB2000-memory.dmp

                                                                        Filesize

                                                                        136KB

                                                                      • memory/4952-160-0x00000000068F0000-0x000000000693C000-memory.dmp

                                                                        Filesize

                                                                        304KB

                                                                      • memory/4952-148-0x0000000006250000-0x00000000062B6000-memory.dmp

                                                                        Filesize

                                                                        408KB

                                                                      • memory/4952-163-0x0000000006E20000-0x0000000006E3A000-memory.dmp

                                                                        Filesize

                                                                        104KB

                                                                      • memory/4952-146-0x0000000005970000-0x0000000005992000-memory.dmp

                                                                        Filesize

                                                                        136KB

                                                                      • memory/4952-162-0x00000000079B0000-0x0000000007A46000-memory.dmp

                                                                        Filesize

                                                                        600KB

                                                                      • memory/7296-456-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/7296-465-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/7588-3021-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB

                                                                      • memory/7588-3022-0x0000000000F50000-0x000000000141F000-memory.dmp

                                                                        Filesize

                                                                        4.8MB