Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
219s -
max time network
223s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 14:13
Static task
static1
Behavioral task
behavioral1
Sample
TF2X64.zip
Resource
win10v2004-20240802-en
General
-
Target
TF2X64.zip
-
Size
110.9MB
-
MD5
4eff951a48869de1fbf8ae9e5fc52249
-
SHA1
c97e8c7b81d9a811c5f3d69ae47a52e71eaf9c86
-
SHA256
576486c34af89bf133b029ab03f04e01478b1ccc2de7023429190305b55d3793
-
SHA512
bef342061580cb3e455d881b614511de5aaa7b22119c400754492952939cd935d19c001bcaf65425c97a46b724f29f52ca2d20c2a48e8f56a830b3f32c296b75
-
SSDEEP
3145728:o/SvA40nR9Vq9PRXM6mIRmQzF5wcPbqsNlmrO4IYnBI0Wh:oed0RadR8Y2eHNWOy/S
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation Launcher.exe -
Executes dropped EXE 19 IoCs
pid Process 4132 Launcher.exe 2260 Launcher.exe 756 Launcher.exe 5112 Launcher.exe 1704 Launcher.exe 2096 Launcher.exe 208 Launcher.exe 324 Launcher.exe 3056 Launcher.exe 388 Launcher.exe 6756 Launcher.exe 2500 Launcher.exe 1952 Launcher.exe 3272 Launcher.exe 3352 Launcher.exe 4416 Launcher.exe 2764 Launcher.exe 4832 Launcher.exe 4484 Launcher.exe -
Loads dropped DLL 61 IoCs
pid Process 4132 Launcher.exe 4132 Launcher.exe 4132 Launcher.exe 2260 Launcher.exe 756 Launcher.exe 5112 Launcher.exe 5112 Launcher.exe 5112 Launcher.exe 1704 Launcher.exe 1704 Launcher.exe 1704 Launcher.exe 2096 Launcher.exe 5112 Launcher.exe 5112 Launcher.exe 5112 Launcher.exe 2096 Launcher.exe 2096 Launcher.exe 5112 Launcher.exe 208 Launcher.exe 208 Launcher.exe 208 Launcher.exe 208 Launcher.exe 324 Launcher.exe 324 Launcher.exe 324 Launcher.exe 3056 Launcher.exe 388 Launcher.exe 3056 Launcher.exe 388 Launcher.exe 3056 Launcher.exe 388 Launcher.exe 6756 Launcher.exe 6756 Launcher.exe 6756 Launcher.exe 2500 Launcher.exe 1952 Launcher.exe 1952 Launcher.exe 3272 Launcher.exe 1952 Launcher.exe 3272 Launcher.exe 3272 Launcher.exe 1952 Launcher.exe 1952 Launcher.exe 1952 Launcher.exe 1952 Launcher.exe 3352 Launcher.exe 3352 Launcher.exe 3352 Launcher.exe 4416 Launcher.exe 4416 Launcher.exe 4416 Launcher.exe 4416 Launcher.exe 2764 Launcher.exe 2764 Launcher.exe 2764 Launcher.exe 4832 Launcher.exe 4484 Launcher.exe 4832 Launcher.exe 4832 Launcher.exe 4484 Launcher.exe 4484 Launcher.exe -
Checks system information in the registry 2 TTPs 4 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName Launcher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Launcher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName Launcher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer Launcher.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File created C:\Program Files\nw6756_1494229366\nw\index.html Launcher.exe File created C:\Program Files\nw4132_1322114139\package-lock.json Launcher.exe File created C:\Program Files\nw4132_1322114139\nw\fav.png Launcher.exe File created C:\Program Files\nw4132_1322114139\nw\icon.ico Launcher.exe File created C:\Program Files\nw4132_1322114139\nw\index.js Launcher.exe File created C:\Program Files\nw6756_1494229366\nw\icon.ico Launcher.exe File created C:\Program Files\nw4132_1322114139\node_modules\.package-lock.json Launcher.exe File created C:\Program Files\nw4132_1322114139\nw\index.html Launcher.exe File created C:\Program Files\nw6756_1494229366\nw\17100998902560.webm Launcher.exe File created C:\Program Files\nw6756_1494229366\nw\icon.icns Launcher.exe File created C:\Program Files\nw4132_1322114139\package.json Launcher.exe File created C:\Program Files\nw4132_1322114139\nw\17100998902560.webm Launcher.exe File created C:\Program Files\nw6756_1494229366\package.json Launcher.exe File created C:\Program Files\nw6756_1494229366\node_modules\.package-lock.json Launcher.exe File created C:\Program Files\nw6756_1494229366\nw\background.png Launcher.exe File created C:\Program Files\nw4132_1322114139\nw\background.png Launcher.exe File created C:\Program Files\nw4132_1322114139\nw\icon.icns Launcher.exe File created C:\Program Files\nw6756_1494229366\package-lock.json Launcher.exe File created C:\Program Files\nw6756_1494229366\nw\fav.png Launcher.exe File created C:\Program Files\nw6756_1494229366\nw\index.js Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Enumerates system info in registry 2 TTPs 12 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Launcher.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Launcher.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Launcher.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry Launcher.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133722657680446694" Launcher.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry Launcher.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2260 Launcher.exe 2260 Launcher.exe 2260 Launcher.exe 2260 Launcher.exe 4132 Launcher.exe 4132 Launcher.exe 2180 chrome.exe 2180 chrome.exe 2868 msedge.exe 2868 msedge.exe 1724 msedge.exe 1724 msedge.exe 2500 Launcher.exe 2500 Launcher.exe 2500 Launcher.exe 2500 Launcher.exe 6756 Launcher.exe 6756 Launcher.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe Token: SeShutdownPrivilege 4132 Launcher.exe Token: SeCreatePagefilePrivilege 4132 Launcher.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4132 Launcher.exe 4132 Launcher.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 2180 chrome.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe 5228 firefox.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3844 Install.exe 5228 firefox.exe 6768 Install.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3844 wrote to memory of 4132 3844 Install.exe 100 PID 3844 wrote to memory of 4132 3844 Install.exe 100 PID 4132 wrote to memory of 2260 4132 Launcher.exe 101 PID 4132 wrote to memory of 2260 4132 Launcher.exe 101 PID 2260 wrote to memory of 756 2260 Launcher.exe 102 PID 2260 wrote to memory of 756 2260 Launcher.exe 102 PID 4132 wrote to memory of 5112 4132 Launcher.exe 103 PID 4132 wrote to memory of 5112 4132 Launcher.exe 103 PID 4132 wrote to memory of 1704 4132 Launcher.exe 104 PID 4132 wrote to memory of 1704 4132 Launcher.exe 104 PID 4132 wrote to memory of 2096 4132 Launcher.exe 105 PID 4132 wrote to memory of 2096 4132 Launcher.exe 105 PID 4132 wrote to memory of 208 4132 Launcher.exe 106 PID 4132 wrote to memory of 208 4132 Launcher.exe 106 PID 4132 wrote to memory of 324 4132 Launcher.exe 108 PID 4132 wrote to memory of 324 4132 Launcher.exe 108 PID 4132 wrote to memory of 3056 4132 Launcher.exe 110 PID 4132 wrote to memory of 3056 4132 Launcher.exe 110 PID 4132 wrote to memory of 388 4132 Launcher.exe 111 PID 4132 wrote to memory of 388 4132 Launcher.exe 111 PID 2180 wrote to memory of 4252 2180 chrome.exe 113 PID 2180 wrote to memory of 4252 2180 chrome.exe 113 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 3696 2180 chrome.exe 114 PID 2180 wrote to memory of 2604 2180 chrome.exe 115 PID 2180 wrote to memory of 2604 2180 chrome.exe 115 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 PID 2180 wrote to memory of 3532 2180 chrome.exe 116 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\TF2X64.zip1⤵PID:4108
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\Temp1_TF2X64.zip\Install.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_TF2X64.zip\Install.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" /d9032id9023939393/Launcher.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exeC:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Launcher\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Launcher\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Launcher\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Launcher\User Data" --annotation=plat=Win64 --annotation=prod=Launcher --annotation=ver=1.9.0 --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x7ff9670fb960,0x7ff9670fb970,0x7ff9670fb9803⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exeC:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Launcher\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Launcher\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Launcher --annotation=ver=1.9.0 --initial-client-data=0x15c,0x160,0x164,0x138,0x168,0x7ff7f841da20,0x7ff7f841da30,0x7ff7f841da404⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756
-
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw4132_1322114139" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,9369492707627025280,4017612035005213270,262144 --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5112
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw4132_1322114139" --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=1984 --field-trial-handle=1956,i,9369492707627025280,4017612035005213270,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw4132_1322114139" --no-appcompat-clear --mojo-platform-channel-handle=2260 --field-trial-handle=1956,i,9369492707627025280,4017612035005213270,262144 --variations-seed-version /prefetch:83⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:2096
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw4132_1322114139" --nwjs --extension-process --no-appcompat-clear --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1956,i,9369492707627025280,4017612035005213270,262144 --variations-seed-version /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:208
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw4132_1322114139" --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=1956,i,9369492707627025280,4017612035005213270,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw4132_1322114139" --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=1956,i,9369492707627025280,4017612035005213270,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw4132_1322114139" --no-appcompat-clear --mojo-platform-channel-handle=4596 --field-trial-handle=1956,i,9369492707627025280,4017612035005213270,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:388
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1076
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff96864cc40,0x7ff96864cc4c,0x7ff96864cc582⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1832 /prefetch:22⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2384 /prefetch:32⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3280,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4576,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:12⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4868,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4792 /prefetch:82⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4608,i,8056188157525040777,15034691673895134706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4828 /prefetch:82⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1724 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9620246f8,0x7ff962024708,0x7ff9620247182⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,14097359047519618084,389605807621775104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,14097359047519618084,389605807621775104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,14097359047519618084,389605807621775104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14097359047519618084,389605807621775104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:5360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14097359047519618084,389605807621775104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:5368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14097359047519618084,389605807621775104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:6832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,14097359047519618084,389605807621775104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:6248
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:3592
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5228 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fabc58b5-dff8-4104-a63d-3cebd7b4c581} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" gpu3⤵PID:5672
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2404 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60d600a8-62dd-45b2-844b-761f55a35871} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" socket3⤵PID:5860
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3284 -childID 1 -isForBrowser -prefsHandle 3084 -prefMapHandle 2792 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06d79155-4319-45e2-987b-d9864f1bfe99} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab3⤵PID:3880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3308 -childID 2 -isForBrowser -prefsHandle 3708 -prefMapHandle 3712 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e7c450b-c6b9-42c5-a514-a05dcbc72546} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab3⤵PID:5812
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4976 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4968 -prefMapHandle 4964 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c528147-ae71-49e0-b3c7-a504fec397f5} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" utility3⤵
- Checks processor information in registry
PID:6992
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 5396 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7406f2ad-0fb5-4a31-ae5d-69bf232bede7} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab3⤵PID:6464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5556 -prefMapHandle 5552 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bae1fd3-06ac-44e0-a0d9-51ecaa9c472c} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab3⤵PID:6476
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 5 -isForBrowser -prefsHandle 5584 -prefMapHandle 5572 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62b918b8-5c7a-44af-a6df-e8a39005ae8e} 5228 "\\.\pipe\gecko-crash-server-pipe.5228" tab3⤵PID:6488
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5336
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5520
-
C:\Users\Admin\Desktop\Install.exe"C:\Users\Admin\Desktop\Install.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6768 -
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" /d9032id9023939393/Launcher.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6756 -
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exeC:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Launcher\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Launcher\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Launcher\User Data" --annotation=plat=Win64 --annotation=prod=Launcher --annotation=ver=1.9.0 --initial-client-data=0x278,0x2b4,0x2b8,0x298,0x2bc,0x7ff9670fb960,0x7ff9670fb970,0x7ff9670fb9803⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw6756_1494229366" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2044 --field-trial-handle=2068,i,17247313111520277462,14185672898956501031,262144 --variations-seed-version /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw6756_1494229366" --no-appcompat-clear --start-stack-profiler --mojo-platform-channel-handle=2064 --field-trial-handle=2068,i,17247313111520277462,14185672898956501031,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3272
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw6756_1494229366" --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=2068,i,17247313111520277462,14185672898956501031,262144 --variations-seed-version /prefetch:83⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:3352
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw6756_1494229366" --nwjs --extension-process --no-appcompat-clear --first-renderer-process --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\gen" --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=2068,i,17247313111520277462,14185672898956501031,262144 --variations-seed-version /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw6756_1494229366" --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2068,i,17247313111520277462,14185672898956501031,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw6756_1494229366" --no-appcompat-clear --mojo-platform-channel-handle=4644 --field-trial-handle=2068,i,17247313111520277462,14185672898956501031,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4832
-
-
C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\d9032id9023939393\Launcher.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Launcher\User Data" --nwapp-path="C:\Program Files\nw6756_1494229366" --no-appcompat-clear --mojo-platform-channel-handle=4572 --field-trial-handle=2068,i,17247313111520277462,14185672898956501031,262144 --variations-seed-version /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4484
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
MD53faf439a6cd9d9a9fa9f8aeb85cd0f05
SHA12af297f14c4a0d9ade6663d6eecb8fa051ea85f8
SHA256a04a437646dc6d3ca3f6563384c0ed1a14364ce502df8fe75d6200cb53d229e0
SHA5122b9bacb4039f967871af6fe772245e1f83f584ef17e49345eb4f000d49a4ba8c9ee3d154e61713687861775ab5e5496959b58b606edad4e489d2444c487db971
-
Filesize
554B
MD5fef3c629b4988e5756d334f251e96748
SHA102ec04f252e2a00de7f991c212847b533a1c1165
SHA256b94cbaf6c5e5c6f2222852305bca0013619f49ec1cee54e5cf4f84266d1eb13e
SHA5128f488a4a40c1ee7103c30ba1c1b17fb43d7fdd01dc98f81008d16cc2ffb8fa419985d212d4a00e50e4d470d27c1438af3861c70b23ac4f191a7ffd2b96d2245a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\73ddd9bd-85f8-4aa9-ab54-7a7b1dcafbb3.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD5b0005302814b4c6fda09eb7e7dad1295
SHA1c849718858b01f46363c5849710c2da80de0fc14
SHA2565c798224b5ff882c9d7e6936f624b6cb38dd328341109e5f022a8987aab0bdc0
SHA512f8f3869fe2d2b2fcf7e5c103528fe0964fef281a22ff02318fded884fae905f40cb7fb5a7eb3d1d690416128d4c26394b629f904dc3ffc46a6b2998421adc506
-
Filesize
356B
MD54a84390b78c6cfb4ca707c7cc86c7610
SHA15df97a3f750897360a2d77eea4c7998546e0895e
SHA25659dc5a4036c80b0309a69c80dfcb7f591bc022fcf7a93a5bac9b5ae970b0d4b4
SHA512aeb7a5f5432546ec5dcbec5513f6695826ebd8b22b71c6344d25ee0b2c497806593920916a521a1c876810bd7b4a3c26e3332b0b5964a03ea879c6e90f9c4178
-
Filesize
9KB
MD52152f18aa4a4a4b728f35e76f2a70107
SHA181ff1db371b7cb9eee2dff208e5eda7f23fb81a2
SHA25676795dc62ae515194f9b2d054322f89c9624c1734988ec59d44f02aa27861738
SHA5121d41cd184ca0437780826872d2fe69a6ecf457487f949d01bf191302f51b9b248a99b1bbac0e570160666a521df4e55199f5929570acf46b02fd41fbf9b7350f
-
Filesize
9KB
MD565032495e00fc8db7e4eab500487b985
SHA18b1722cfad3e78956826ecec6440161e162d70e9
SHA256a01f92dd4292d97e0de959c31f42f96340e9f89a2d26b60142ac8790da28108f
SHA5125b20637ee33fbfb9b70c41411e27a95e31a90d30118e2aa19918fa8316eadfb6bd250f83808d72a2481abc8f7c71b308958a83a6a58e1330998e8f01456cedb0
-
Filesize
9KB
MD5c02269abe056419dc1818bb0a6f784ff
SHA1ad4f6b160d7d5aaadfe2a5a2864c9eddd07d6135
SHA2569d87e338d79853cc207bc63a911013559901ab0b6f8bea6e362f44786633b808
SHA5128f19ba9f113bb4944bb9f339422408426e1a3f978d6837b01c4696b68da7ea6d0711b53af98c81859ca7460bc10ab97fa4d7f17333e30d9127f7ac448b008685
-
Filesize
9KB
MD55d8219c16b4cabd237b5e0001d2dbca4
SHA1b78b5e2dd657d612df17a9304c82244c413d6b28
SHA256ae4a3025239d56944be63cd44adaa56f929aedd7910879baf639d536e96db8f4
SHA512e126538d1da282e6521d63f71aaee3c8bdde7979671cf5df7dfb42d7390512cd0bf1aef035291a41ac4b2d49fa4eb88a46d5018ce13f0b6c71142c03f3d2fb31
-
Filesize
9KB
MD552ec741902fe25840e2e38ab204a798f
SHA1f1f7559c3743a62cf3aed161085ff87df4bf45da
SHA2565e20e9c9c1cbdc30c151e45f318eb66993bd7d856b6d1d83fcdababb3bb61a63
SHA51219f6592abf0983ed76129aeccd324be0534540b7b962e259fe67299a237a3ffb45e6e33cd7256e5c5d21c03f1419cb06333e1fe250a036ad4ac8d875e2f1599c
-
Filesize
9KB
MD5c13116aeb5c748399fa0b0e0f0cbbf28
SHA1f98c91fc505376a03d03aa7ee5b4fd51bbd1a353
SHA25684d54ebee205bc2214f9aecb33a1341246c5c07535eb18c0a3efbadca87fe3e2
SHA5128f9ad1376cd17512619910a9420a4942edb7adc636a8e183c55b489d676f9f3506fd52a188766093574f44e78a2965077030109145abbe948a05ae59619902c5
-
Filesize
9KB
MD508d508273e98ba8ac4379297331bb52c
SHA1506e258f5134bbf91cff1d44403068bc5b7bb050
SHA25699a863dd3616f6511cedda0a1cdd0c469f7089aecb34135421de022f560bb392
SHA5129e0e100331745e1f4935523d67d9a7757f9e075e1b3216468b7282ad1e9f5b330dfaf957756663b7bbdcbeb24b4652a9d20605b341d9635dc8dd7db2315948e7
-
Filesize
99KB
MD51bcaf402354981430adbd883fdf95020
SHA17f134a93ccc58acace34ac90688a7d3c7a9d687b
SHA2564d9474712e1a0496e9a390e0652e84d7a4211f48f8c0cb1544949f45b8f67d11
SHA512a06fd028cba47f5f07fa3bfa35bea83bb6254b0c2bc5f0f0a8316cb230c4945336864e3ae015fa1c0cab63b7a5b54fbe0d636ac16655d0bdad0949f97517640b
-
Filesize
99KB
MD582d6da0815c0e77cc6a40bf99feae0ef
SHA117bdbecc8dbf0355c78d3901c85b720279b38e5a
SHA256a40c4379b422fd1f3229f1d7165307edd520fc3e523956fb3b610867753155c1
SHA512658122f2524a7231ac50223b81d8a4ac66320f700f9d197784bd7b1106a04076ef219ca71ae316671f060a06a462f4a5e9b68b4ec0bc74f908fe570ad0e6badb
-
Filesize
40B
MD54bc0da0b6a7dc7aa6ac8f58c3df25b3b
SHA10b4d33a01d5c69376bbe47f4565a7cd6ec431a9c
SHA2564db698562b145565d4418616292d66217fa45207e9cc2a1570d0fc455e44e2ee
SHA5121bd5ad17e72219ecbd19a30e3e658f8e8d730bc8592200073bca5ff1edd0138cd2cdbdb7d01dbb26965f27e6424496a2670622432a98af72a9a6e052d28c9b8b
-
Filesize
148KB
MD5728fe78292f104659fea5fc90570cc75
SHA111b623f76f31ec773b79cdb74869acb08c4052cb
SHA256d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
SHA51291e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
-
Filesize
882B
MD5ff4e0f2d9ae3bff6b45685ce582bd94b
SHA145db5174a09553402bb31a032728df590cd89d14
SHA2561f8a08e282317ac753a1c446758d4624bbd456c0d0aaaaf20d8912761e0776ce
SHA512d4b574b4dc1c2009fb5d1a22b01256e60e9b86ed3a3f3b8c998e5c7ce3a2dbf459c2ca735f7ab543a5819e10969bb8aa05e003b5b48bfb5fac658fda2df1cf7d
-
Filesize
882B
MD5f151ac3ba36f3e0cf642ddd60b5ffacd
SHA16be073c858fb351ca5d99d44582b3ce5034b0ace
SHA2560be41f71a43c8e97d5248726a07cb6305e8c256f52217417ebcc0abc5adea582
SHA512a7654d22f6c07741568e27c822d03407174e975b0bcb0078a7881b981c31736797a6ca0283bbcf9a9df23cb8a72235bf4559ad01c52cce3852e5588d4c225cc6
-
C:\Users\Admin\AppData\Local\Launcher\User Data\Default\Network\Network Persistent State~RFe5944cf.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
355B
MD5226af1114caea22615e62814c05c1503
SHA1afb59631c87d9cca399354b7347f95fb3168bdcb
SHA256e16752d254bd6db1b12638117d80a956a527c4f94a59a7209662e6cb40148d29
SHA512ca297689fe7b6561f52c41812f7f579bf780e0d9e2cad15d84087f7eb3d05510003e6b3da7ee4529585d390ffb334fba291b9ba7ad8eb32623761bda9e9f9a98
-
Filesize
355B
MD550073a35113e916123c0ea4079eaf843
SHA1d9073a7ae3c67a3f2c5ce17b42431caa5660ed03
SHA2569631bf99f2f7e6d0f2a8dc89ffc042c4aee6afc0f474d91dc31c8dcfdaa83e9c
SHA5125521f3521875fce56558debc3d4347b782647bc573098e21cdcbf33b0de021ee395b192f6150327c76da54d31c74072449747a2c76eb2df114d8ce6b4965ac56
-
Filesize
355B
MD5e47a6cca721a113694b4f0e10c36793e
SHA11637b1f927c0e5b1816612b95698a4c43de367cf
SHA25687e0dc49ebdaf1b1c4de179481cabf04e778d085188bcc8f7bde874828397190
SHA512789f3cc1a06a8f965357be7f238e9d86b0c7319438b2122887dc43f8ec1e95f0cd0e0370b6ed990243e78a07fe691e61879898bf9189feec3e217824b129c908
-
Filesize
4KB
MD5771479c8f6f8aacdac198570024394a5
SHA14a356657eb9bd0337923625b1beb0803c5f56569
SHA256ea33a90469106998b496084174454c4c2c07332e71876b53abd496d2468b5c04
SHA5126eb66c5100e9f1c9b62100a676054d29b5235a126384f00e6ec569876e960a7dff6dd4c4b6ae28222fed9f9d905c752eb09c451fa65a72e63029418c43d06414
-
Filesize
5KB
MD57bf5e3932e3419997172f7abc6af09ca
SHA112da21295b3e16b1fe36fba159dc802e74e3ff59
SHA256208b46409db900cc7ab71a4e6c28289665f4ba9a4fbc5bdec4e5d3a9f6ee1cf0
SHA51232c5a4adcccbd7e4450c8c59e9e78d3493b995bb0312245cdd1eaeca40c330babbc065c3ecb969c7c5862a07b28b6ebdad53cb3f356c376a7c8e4540275c0b01
-
Filesize
4KB
MD5dba42c6b218ce3fee579069c5f375f43
SHA1010c415002abf0646a43fdcf5a405b37292e7d0f
SHA25641c296a5aa07fb38364c34b151dc85f54b681c08b00a4524842650a87e539c76
SHA5123033166b54c13056bec21cf2cb5a6aaaad852f20a20da37141ebe7271c0ccc97ba5093d415c5e58d143611773f4ef6546b88d49658973e1bb49aae7a599100d1
-
Filesize
5KB
MD5fc892213be3a30d5fb4a76fa8c7aae85
SHA1abe68c83b4c17669ed9babd2dbab08e0fee5e229
SHA2566c78c44fbf07d180b49d2e19dd2405917e5ea5f7c3fcbd24b24a62cd9c640418
SHA51239056ce070c565bbab39962b05a9d98891a13e55196e3ee724dc264e28b95a2f3d14b20222c9169773d3c772277e1f89dc75cdaca79933cec3c31940b3d52ce4
-
Filesize
5KB
MD51f2850cdc3a8148e1204cca77faaf293
SHA115462624b105b4a54d14e7b9356a71f92481c4e5
SHA256b4fdc22fe585e71dd26577d7a386be1edba4f8e2e3b600105bc46803c0f335e3
SHA512b041dd264f17bf767803dee7d28a6161047686043206742579988da0af26ffab184c9defc9eb2e801791b58f7c4ecb29e4309277ad639248c7e399b9962e10de
-
Filesize
5KB
MD52ed398a14c6ac0a9cbe698e52ac4a885
SHA16d56bd7095fe71bf34432be439e38fd42da5c9c0
SHA2562d92534e5fcc65bd064cb77369430db53b432548c951f2b52659e33c1f21441b
SHA512ae636f772f56540b7a7b1144b0d1f308f11e055dcb43ba5363d358efdc5439281b29e924bb1cc2aa240f848ef93e66bab608f0e7edf173cc04ebf8577545eac0
-
Filesize
5KB
MD5e6e986c614670b05516f7180100b3488
SHA1f9f9766c1888a60ce4e0e63c93051762ed3dd392
SHA2565f2ccadea071a178292b313c56d27b05fdf2e71739025c02e33e57030b9efba9
SHA51261d825e8e89e7a18a971dada6f63751b5a9fb333557701319dd6006da211a605776203ff9bef6bf010eb455369ce08706aae45f8285ff972014cfe3899293617
-
Filesize
4KB
MD5353cd57c76cf7971b7c959323e22ef33
SHA1f2c283a655051df8e797048e5110f72120359f9a
SHA2563383e5d73335df689528fe1ef47030be10ed58d53d3c22241a734aa9abdbd92f
SHA512be9595a797e083412f290c21d4483165878e9d74b7c294a5ad05c8dcdd0d1bdf7316b6a6c19b82a25d464c9682ba4c3c70555ba28770e086e8fdc526ce23ed74
-
Filesize
5KB
MD52ca1b0f181e6f3b6cd34627c97b8636e
SHA16371de72e403503909604594fa513904a3730185
SHA256181eab385b6e3402d9e7e9421dc9f973c5a4e6a6c102fc594602d30be0ca8299
SHA5127cd2e0841ace5be92bbf79e3c683d9bed498b0787c4172f3db4860580134c2ffef161a6b960d3793eab2ec44801249f5501fdd3a0892af25cc4c03b10c17228a
-
Filesize
5KB
MD5c3c51f7a3bb1f3658bc2759ae6a06674
SHA1f817e4278efc5a213eed59587977af11f3c81aee
SHA2563802357c8390a4f1f5dde8ffdba760e052c4803fa567879b8aebf3eed8dceedc
SHA512d5833199f1d1dcbce0ececa956e6ce504f1c7fd5c47a3a6b03e5fc815036fdc03faef87c52cb861a56d88babfedda4b6494b697d366d1574e84b95cd88c6c007
-
Filesize
5KB
MD5dcc0740d826d03196a041b8b107114e2
SHA183a17c5438b3ccf68f3d316665e8e3e556c7f3c9
SHA2565ecfc102a8b5f8271971780cbf167a8be76f9788e7e06b903979bbe6db71221a
SHA5123464afcb76e9ef0c6d5db4d07d6afff16372c8fa79827ac5fd48f4d2df9c3d4a8d0b062d09e1fe8dd1c550ae57528b8beb4cb71c229c9255b5d178dda358bad5
-
Filesize
4KB
MD588fad6fde31991c2d89d49ce27743f62
SHA1b3b5b5a18a084aa093a9118f5132e4ae163de5eb
SHA2560ef8304f82b0b85b829a9547fcd02d157802dcd6b172b447fc67f7d2bbc746df
SHA51216cd72b22bd145d89236aa0c76284e3a1190df2376d1062926c5013a0dfed3c9ba67179f4acb8119da6f9715ae73bb27c536c067e67808c8f8b92944f4f2a519
-
Filesize
5KB
MD54c1ff653255b33c58ea39dae6a2c3c19
SHA13af7e389e519206e53d754e9276106674a91fa7c
SHA25631f690d45c5961abcb0ed4b5690dfc07719acec19086f1020a4732a88fea26f4
SHA512d5311bc2aed931229180e4346de444b3a8e4b73de0f45c1f37d9873535e8ad1c9dbf03597b325b217a4e655e293433dfb6af978f909ed9ac161f78ae235c1f89
-
Filesize
4KB
MD5d6b7b38d31872b273eab8fac5159086f
SHA1f187c12751291543b0a1dc51baae90095bb89b08
SHA256086436ee2ebd6b407f70caaf1e9622c57b6da681be8cbac6747a4fcabd6efa0a
SHA512adace344af34c33cdd07026674781523be6ac02f99e3758b5a27877295a0674adb14b6d9f62e78a7180796829d50941c81a7ee00e82f730628ba36d4341e8470
-
Filesize
4KB
MD5fe5aad86ff2bf4332a51894ec2ee274f
SHA17195574964515784c298a44a6a7c647821e85933
SHA256d865c374bfffcfea4819eb141196e94b5593a93fbc25b703b3947778ea56bb51
SHA5129cb0830aebc754b356122ab7b7db204d3a6e58d79d03cc0c7a9a932dbc9f87a1db15b722b06fb0f47b39efd95c7a0caf0e464ec79c3ea8ab7f0cc27703518f6c
-
Filesize
4KB
MD52846f25d233ff54cb8c2ea9fdccc5bc9
SHA18212409fc22072ed706ff87a3c3735dc1ccde701
SHA256bb74cf337c3aead038c1b24ef8a71250131de2133bf1848d3ec86a061767ea9c
SHA5123a26449de19c341b946757ce16f9a157c48e03ef27eadc1bda0d09adef06622a66ce82fa8aef1d305f59ee2164615f748168deab317eb762b97d632d7c619c95
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
2KB
MD57b6bd52910f789af56d3cd5c64c94b96
SHA1888eb2512a3b652844c948257972f1e0a5a9961d
SHA2564646edf4a6dc0b895340c90cdaa6e25443b73b6c31499bcb1b6ab4561cbcd12b
SHA512d7c72073507e96f77d2ea70fb26302b7e924e2957481e3be2a61afb958afb4d0768fae999b67e74154ade99c0d71d61beed34e9de43dac2d624374c5b00d552c
-
Filesize
2KB
MD5ca04da37f7150b1151e078ca0d0d4123
SHA176b2dce5252dc6277016571ed67304f5ea1562ee
SHA2565708006f255f97a42dc4601b7986c06cdd2ac721567231ded5e3b09c26501037
SHA51250d3d9d60cb10893060fe7a33873d2e7992795846852070ef9c45c2327cf1e3882341717b2b1769be49bab608d018374856a9eec4a4dfefafffb48ff1341aef0
-
Filesize
2KB
MD552053bc9c18f71e2c34a1fe5e1c9701e
SHA1274628b9746aec2b5e73132925d91d07c298ba8d
SHA256d92e05dcb800c39f48514b101cfaaeea4caac518d6c2a6dd1dd89270da9513cf
SHA512f56f30ae73c5a6b0e76a5960b41eafca4d55cc6add774315a7657cbcbc3c323d93e3936a8db85d93dd88c5ec7eea573e99bdb1969cf4beba21fc36d1943ca141
-
Filesize
2KB
MD5b0b26c49be3cdbe510df8c7e9cecb06f
SHA1ceb66c35fc434efd586df3673cff99e4d5820623
SHA25670fb4a7c73e23887ffe291e51ac975fe0d04d1ebe6c49afbadd66622881915d9
SHA51294b8261a8addfb53596c610654e1d91a364bd22838114599af09ef7332e7eae21f0da5b98fbbdcee8880363d4e6c5edc662b1b640dcc6077bdacb5206c2c8297
-
Filesize
868B
MD5c6088f30023c4f69685b96de4da1a1c0
SHA130800b3c2e5aa4a49cfae106d5a14a2ac3f8b024
SHA256609f926badcd40cfef51c7f202945721db0e422c9b966825fe814f033d8b425d
SHA5120415913c11a54c6b89e2ebba0c9c04a18b7c49b7963a45518259e052836a85675c3a7fcec801da52b87629394018f2e15cf1113aacc1fb3dd448e2771aa0f921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\530a2282-072c-486c-9e07-2f153f158ed0.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
5KB
MD5c6e2ab369e8a48b83cdd8931c9c505e4
SHA16aed8abad77d8b352d32812df03ba8b245f0f951
SHA256e929d61afe4478a2dd0593dc5204170333dbe8cadc667b66fd20efbd6c523b76
SHA5122823a0febd63f567384e08612466ffb0d115019f419fcca40846429308dce26374abe54c8cc0cae5e7dc11561da80234b3856f26009cd540f52f3a0219487b75
-
Filesize
6KB
MD589e36a05803edaa49db614729d022639
SHA13bac0ee04234f4e35da7ee5ff791cf6470d22ce6
SHA2563cdda18202cee2db3def3d597c2c5e320a9eb6690da747dd7809d2ab5b234908
SHA5121861e400ec73ce684c3902bf400eefcc92d18891f25f033a85e9f1cae903f87f8a300c91d86b4186687aaf1801051df0113844ae81f4e0efd43e8d66ac366d19
-
Filesize
10KB
MD58bfc586198b5ea09794fc77f67c79e2e
SHA1ee4f74085e94f359975b13559ec1dcd0fcee58ff
SHA256d3ccd5126a3ce1fc12f20409d1014315d40cc70a4af4c796c4a7598d804fc3e9
SHA5126e9c10b4b054064526f3861d4ef30b4316b18d6032f8f7ce6f8a923b926bbe1078887f02bd9e45a55aac3acfac116a1cc54dc33e90693b6a4bd00598ae93dfa3
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bxumog7h.default-release\activity-stream.discovery_stream.json
Filesize19KB
MD5849e600186c17fb07f90f698cabb06e6
SHA1b60c1fa2098bb2ce8b4667918d6c5018d7f6550b
SHA256325e1c95fa89bb5e74df94d32afcf90fb5b184f444c72af4a767102bc813b682
SHA512bde0fbdb627fd28244de6536ec42790b4d9f3e0a616306dbac26f39eb1070a314e5cddb17ea2452645d8e6b3e7915d9d93bae0efd3d71100cedd0a3e19c42595
-
Filesize
4.6MB
MD56f09da277d56c0cc7ed7fee75bcdda2f
SHA101ba82ff99150ee54c1f1f0e5de0a9edd97cb544
SHA256bb339c0db762a3f92877f80f4a23545d5dc483b085b88d8aaad28a6650d63688
SHA512c37ae7fd702ff00132496c8705c3000d2c83034163c13fc633a374701ac09fa8ec76c267ee0f7ba86ec32915522983326a7e3fed8a31a246153bc312ce11f8cd
-
Filesize
4.7MB
MD52191e768cc2e19009dad20dc999135a3
SHA1f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA2567353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA5125adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
-
Filesize
1.9MB
MD58fb19b8e58a567a27619a91b99ad8bca
SHA19f24a832705ea853b4c0cfe9f2100f42aacbd0bd
SHA256424a34741ce0e5104df6d33ea16633c018af5f3a7396734218d1a6eb4f70b1c4
SHA512b0415aa5728d39efb01d3e0cb082bbd4f42ff1284447ad89f85604e7ebc6da2bf479af7d326282920c543f351e856c5e3b1a97e2fe6c3bcf198e619165f3be5c
-
Filesize
10.2MB
MD5e0f1ad85c0933ecce2e003a2c59ae726
SHA1a8539fc5a233558edfa264a34f7af6187c3f0d4f
SHA256f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
SHA512714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
-
Filesize
444KB
MD58aa1a64d7094509196fcb4a72d608213
SHA1e7ab1c7ca53581578ae56dc0211773ac780a4f91
SHA25615e7eafcfe14bd255c21360de3d019cfa5852bd059c36779c351c0592dc841f6
SHA512a915759817f6a84dd061f45415e6fa9b00d7060095360257763342d59252525de4c04956e2e15e23fc3465074d1e719a0d988f6798aa38ba3471b8e38aa70200
-
Filesize
7.7MB
MD577d1e0959e09d82055eaf8a96f9aac5a
SHA1e8156a4fc1f5b7de12d2d072579ab156c1bf4139
SHA256f31637764d037b603f93279fda6dcfd0ba9f9f42e1eac77da4dc781757820593
SHA512cc0a5b0f09783f171067ae4a643d42ad373858cf7d9b894710fc2ae61cda05055aa5214012b1d8f244d5960099ab19c59b51ce3eeb4422666ad94647f18fc931
-
Filesize
1015KB
MD5edaef65b3082ac1502e46a7efe9a7260
SHA180fd9d68b4a0af62ef7f53d58ee9fb3ef1ef32c4
SHA2567f8d7ac684642fb44625b0e32c0d8d20df0f661db616b157be04dfec918416eb
SHA5123564bd96293d4a07c15d2ddd50abb531aea0a62cd4e0a8e70b60c7ef015b6e11f8221f353b668b0670938299770cf3607303075fc5f34bb73f9abbd48f666726
-
Filesize
448KB
MD509a27daab8ed231994af216a98a73b85
SHA1c2211a4cdc878c7685f30454bf9742b68025d22a
SHA256b8a8ee9f3dd6946649beb4f3ff96889bc010aec561678903316cfb26d7819479
SHA51240016c3fe93989936cd63ed1e20da403f9b19f712efc31b65d485f06daa7df41ba86da76ca0ea04db2932cb4ef928ff2ab70aedc839a8ce472b83a92ac298e2b
-
Filesize
17.6MB
MD5894ef067cadd618523e1e79542733078
SHA1803322cecd2451f4c5d5869ad854404797a82d22
SHA25612d5ffc46c0e079adc5df938f82058c0ec66fbaa989ce339bbdd81e5f3cd5f6a
SHA512c6f65b9291631c52ff6d2549616a7c371118b8e896eeb0ff46d3042d92378002277814b180dd42789b3e3e5466e8838d43e3f3e239484e2bdf477e729ad71d10
-
Filesize
718KB
MD52f1c41cd4f8d630e965c83608aeb8dd1
SHA1877ee7e4190967d69c6ebf9c6a52327ec10dffae
SHA256a476dbd7731b7db5a771445cb9cd8a838dc706d8986f9e1da3d81fac59cbeb1d
SHA5121780bbeece915ff4d959b13dce849ad608301eab7b299bc8fad9251c2ca392b6833ceece30256ed607b4b5e12dbb7b5e0d247b711901c628b180497eed872239
-
Filesize
1.0MB
MD5700774b8661621c44437ddbc8cb2ec04
SHA147bf0f010008b30c19039fe6e360c6866dae7c4d
SHA256b5e62133ffb3827d75d74d5e23326c9827ea931b693a5e09554809eb4240d63a
SHA512a7c80a80931bf4cf1ff02ad1a6b6e662171fe3add5d6a120e66d92e242757ef18aa30238d0e821ef9dd89f3aac8024eaeac8a79731a33d214dfade0a79740ed2
-
Filesize
1.1MB
MD598acbb1ba1112cfa4da907558ea7cc0e
SHA19e041b920a7a9e9bc0aea6fc7709deb67eecf7ef
SHA2560c57bc73ca823aef5dbb3785cdb343dec62854f80e811df16ac71ba88a039a5f
SHA512a4845ccf34b534d5ff336a909b66f8cd4f48c151540197ebf63242a83c02a4f5a9f992a7975de44ca0f66e810e302a37f331d4bd26afff5088f2c44df517ac86
-
Filesize
4.5MB
MD54d9219f1af3200e8c693c5886f8a26c4
SHA10eb520d9ffa0526c71c0640bb3a345b510cfe434
SHA2561a1d26a3439a3fcd107f1c1b845f5c3dc00121f87ccf6481b3101aebfd09b58a
SHA5128edd540d1b920c7f76f48268e3c207b55afcdb03bf12eb5f32d864067d02a1334963db02c8d4fba8ba76efddf26369ec3660894549d1fe1d205d736d51721dd2
-
Filesize
669KB
MD5c0e7602b0c7d5de0be5e83c20591f941
SHA1838d2038682db7008f6a2776026cd6085db9ff3d
SHA256345726227a3d92f5e2f87fbdea70385690b38f8d181c902254845021093c5697
SHA5127d2ff90ebb6b051fdb050495cf5f3d353f4f14e1d5777d7d181ddb70cdd3ea4f633364fa5a0e2e2ff8c9a5a2de636160e0612a7f45fc65882114caab53ea0cbb
-
Filesize
4.3MB
MD530110969780c95187283ff5f621af377
SHA1f0aefeaf8fe145c54b2d3c492e08ce063d3b0af7
SHA2568445b5f07ac802b1f6966295d08f2f561af77f8a915348e795a4a4480bcfc248
SHA512041ae7ff07302bff55233f0ffe52b67f540f452670d6ff962fb7a2452b0ca0fa261d18ad2b01a15bb82bcf59897e2f533630eb776748c1142d4aa0effeb421e9
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin
Filesize8KB
MD5219913573219a9371f12cbccadd14928
SHA11470a88bb439f6103ea066cdbdeaa6bf25129522
SHA256def0905b3782770f040fd3c13a86178e9fdcd72c2eb684734ec04dd5c1a7bbed
SHA5122d85dcf55903335e3c821945fd13dddd52c603ec37f94e73770a86ea47081ee206f72b8f52828f1909e14f829aa76afc0724287cd718a51b15ba25b5ef516119
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\AlternateServices.bin
Filesize6KB
MD5cb82502606a415ec6a33d45fd2e87efa
SHA18084411ac07a38d6a5430d27218081595dc21910
SHA256fd87717464634c8c3bb43403c0801d85ba36aeec8b864b02173ab32a5f0eadad
SHA512fc1f90245e71738b9fa8998e1a2e6ad19562c0ae585d41619fe91590f24fe0ebcb31131031972ffb43c4fb4df6e745b1c6085199800aab733edf36af691a0d34
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp
Filesize14KB
MD5c725fb356b92954d88516abfe648922b
SHA1247d57df3bf84046c67e2716cb124c85370fb1dc
SHA2568b3b465300d6c0d0506f9a08f87285f48d092b292ae663ae9f7cab0e4bfd9af6
SHA512828ac7032da1df59d0c850274e06159c6f2dda9a4ab976a4f14581fb00181dbbf8f462e581da0e34a09bbf33f3dad1ff52ed2a1a7f41afbefe1e9fab3b79a8fc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD545fb941392d144c10de0b008e2b04a91
SHA1aede416fdf458116fce0faf4be7008ea5b398c54
SHA256e8d28fb43eebb11572510820434b1ad730ab2dc5c966020b4ee9752251632620
SHA5120d30624b89e14efa7c80cfc344798123a0c9bc5e9ee2c4a66cd4b79eba91f6de30d0e97e3cd21a52ba9e50d43fc42e6c8ee2196013ce36ce50603a3c3f411a31
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\3b0e37be-e923-40bc-87e6-ae72f8bb3ab9
Filesize982B
MD535ec9c508c9919a9a032464f522d6139
SHA13128252ab9030431c43a863ded63f6e8a465332e
SHA2567e31f72322d72f17d14e5a629e83da119bdde84ebb9cf53accf9484710b58faa
SHA512e98cc96c8ddc44b636dce163c04c4b4b4d27348760b01f59f7d541e9f85e2e5106b1b226956c349c6f9583fb49a99029f1d77eecf22bf42430dfb5bc226e08e3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\90429791-c431-4162-9768-0d33e3c36b52
Filesize671B
MD5470a48cd2a955c02fa0d7c4fd15bc2bf
SHA1641e7055969ced5830cc07ba64823f502845d2c6
SHA2567c96dba45ca8299e7ad73c8cbd6f85d9a736f1ffd4b06aa2d00706a6a319079c
SHA512f03f9497b1ef8f1064db575f1dbb624682de17c85d5e685a2815e7e289c29012b6064c4b6b31d1273ec090c549f27036e3732b92d22648297b90f6baf9c0a4b0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\datareporting\glean\pending_pings\c2b2b408-a06e-47f5-88ae-406f332e32d8
Filesize26KB
MD5b3a24612869a570118b6bd31b841359a
SHA14a0ce33a0545fb0632c329c66a3bf3907a78b3e9
SHA256ce5f06dae40d0bce78e191ebffe055f05e61febb4c19a4d2676060319be890e1
SHA5125c7453d920daf17abb591b5ed8cd353a7c517fbb879c97e6e59af6bd25319dd445c5114a678d844a32a27124f4d5e79811199b37371cae534d4a1bf40f278058
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bxumog7h.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
11KB
MD51271de10fdae1f67c5549517c829c161
SHA1af6696cbdfa250a978573e827e668a6951ae6927
SHA256f7dd667a2c1faf214211b0f9671502918ce8a9241d797f7658e61c72995fa869
SHA5126b6e182af55095da7b7f91f98cf0650bfd2ed42de3195d472cb9a41d0fad75fcb86c53aff6ffc267726159db0dca58ecc3833b34f013c988a6593ff45fdf0d5e
-
Filesize
11KB
MD52a57e8964ccdbe851b1981101bd089aa
SHA12051823d6963a89ca3ef286c640968e1748eacae
SHA256a5fe2cadcd74ad99afd1624ebe01e4c2224d53dea2092ac5398ca8fdbe2bad0c
SHA512cb680599b012da8e3beea39abc94653cbbc8b70a37332227e678781f8b1f51eee9bf938f0cf09d3dedb168052db9a75e5d26db9fc8435dc1f91008f8c6a6aef2
-
Filesize
11KB
MD59248469f46dfaca3358353a2a3027d66
SHA12886cf0e455cfb451f142f7d82a0598c6fd96313
SHA2561cc7345ed4387519e7a7a667eec8f5aa65e615bed20f833ff7df871028529341
SHA512c342de29c28c08f38226fdf82f65029d05a72b24234be801d086a770af084b210c443cd1b05b015f4ef0800847c30e84e65317d038d440d3e9ca366e03bb9f33
-
Filesize
11KB
MD5a09e422ff2499f17dbf74b43058c5f94
SHA157cc3453c723158755715b0f8035e46b530170da
SHA2564a91c06a9ec4f639922f014724fd3d029e881fe047e847747f00bd4e2504458f
SHA5121f1dd45fc7a936d0e2c97d63805b8bc987c7fe6c8b6ba2826cd4c187e35628b41d3d4e71e37cea83977d559fc7f8ae2c2b5cf8dea67d00975b3c8938dcdf4f87