hxxps://drive[.]google[.]com/file/d/17WC8kdyMaeBUc5vP3ol1zKMGHXepwRuW/view?usp=sharing

Analysis

max time kernel
268s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/17WC8kdyMaeBUc5vP3ol1zKMGHXepwRuW/view?usp=sharing

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5880	7z2408-x64.exe
2128	7zG.exe
6120	7zG.exe
5500	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.exe
236	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
1948	7zG.exe

Loads dropped DLL 5 IoCs

pid	Process
3408	Process not Found
3408	Process not Found
2128	7zG.exe
6120	7zG.exe
1948	7zG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
8	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\Common Files\VST3\FabFilter	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\FabFilter\is-S7LRV.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2408-x64.exe
File created	C:\Program Files\_uninstaller\Fabfilter Total Bundle\unins000.dat	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File created	C:\Program Files\_uninstaller\Fabfilter Total Bundle\is-MAVHU.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File created	C:\Program Files\Common Files\VST3\FabFilter\is-91CVA.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\FabFilter\is-CPHPR.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\FabFilter\is-P6ULM.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\FabFilter\is-FOVIO.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\_uninstaller\Fabfilter Total Bundle\unins000.dat	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\FabFilter\is-7EAE3.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2408-x64.exe
File created	C:\Program Files\_uninstaller\Fabfilter Total Bundle\is-QM0RJ.tmp	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 942215.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
3608	msedge.exe
3608	msedge.exe
1400	identity_helper.exe
1400	identity_helper.exe
6140	msedge.exe
6140	msedge.exe
5300	msedge.exe
5300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	2128	7zG.exe
Token: 35	2128	7zG.exe
Token: SeSecurityPrivilege	2128	7zG.exe
Token: SeRestorePrivilege	6120	7zG.exe
Token: 35	6120	7zG.exe
Token: SeSecurityPrivilege	6120	7zG.exe
Token: SeSecurityPrivilege	6120	7zG.exe
Token: SeRestorePrivilege	1948	7zG.exe
Token: 35	1948	7zG.exe
Token: SeSecurityPrivilege	1948	7zG.exe
Token: SeSecurityPrivilege	1948	7zG.exe
Token: SeDebugPrivilege	4520	firefox.exe
Token: SeDebugPrivilege	4520	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
2128	7zG.exe
6120	7zG.exe
236	FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
1948	7zG.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe
4520	firefox.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
5880	7z2408-x64.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
1852	OpenWith.exe
4520	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4784	3608	msedge.exe	84
PID 3608 wrote to memory of 4784	3608	msedge.exe	84
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 1872	3608	msedge.exe	85
PID 3608 wrote to memory of 4384	3608	msedge.exe	86
PID 3608 wrote to memory of 4384	3608	msedge.exe	86
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87
PID 3608 wrote to memory of 3428	3608	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/17WC8kdyMaeBUc5vP3ol1zKMGHXepwRuW/view?usp=sharing
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8266946f8,0x7ff826694708,0x7ff826694718
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,484901910415295980,15035728644625432189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5300
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:228

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD\" -ad -an -ai#7zMap17788:138:7zEvent27306
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2128

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap11654:138:7zEvent4140
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1852
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.nfo
  2⤵
  PID:5320

C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.exe
"C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5500
- C:\Users\Admin\AppData\Local\Temp\is-RLLHL.tmp\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RLLHL.tmp\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp" /SL5="$30210,33648760,743936,C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:236

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap18939:92:7zEvent19819 -ad -saa -- "C:\Users\Admin\Desktop\FabFilter Pro-DS"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3768
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {27e5718e-494f-4dbe-b646-fb9fd3993d58} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" gpu
    3⤵
    PID:3372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae3dd6a7-a65f-45cf-acb2-e56a2f97b018} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" socket
    3⤵
    PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 2928 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ce91e69-5b84-4d89-adac-07b79df2ab5c} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:5188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4220 -childID 2 -isForBrowser -prefsHandle 4232 -prefMapHandle 4228 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {712e12e4-c15b-44bd-b90e-75ead902d288} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:5600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1592 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 1436 -prefMapHandle 4516 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c68e89a-0e30-4432-adfc-bea2e645cc56} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" utility
    3⤵
    - Checks processor information in registry
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2740 -childID 3 -isForBrowser -prefsHandle 5340 -prefMapHandle 1608 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67f858ef-deed-4e6b-8fd0-97197d6e02f8} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:32
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2740 -childID 4 -isForBrowser -prefsHandle 5436 -prefMapHandle 5432 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23e493e1-603e-4e3d-876d-b3572a70c4f6} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 5 -isForBrowser -prefsHandle 5748 -prefMapHandle 5744 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e1831ff-b21f-4e0a-bed9-aecd31936d53} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:3028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6044 -childID 6 -isForBrowser -prefsHandle 6088 -prefMapHandle 6080 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f2c58d-03ce-413d-bb4a-b12c18a13d8c} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:4544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6004 -childID 7 -isForBrowser -prefsHandle 5648 -prefMapHandle 5684 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4aa292e-b9b1-492f-ae35-bea9971f20ed} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6156 -childID 8 -isForBrowser -prefsHandle 6396 -prefMapHandle 4616 -prefsLen 27827 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc833e61-5a58-48dc-903d-f1ef47b05309} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6736 -childID 9 -isForBrowser -prefsHandle 6728 -prefMapHandle 6724 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3f355ea-6e5c-4396-8abd-9a24091bfab5} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:5624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6716 -parentBuildID 20240401114208 -prefsHandle 6816 -prefMapHandle 6820 -prefsLen 30582 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a3bfa70-63c2-4fd9-9321-e6c1048dcabc} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" rdd
    3⤵
    PID:5036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 10 -isForBrowser -prefsHandle 5388 -prefMapHandle 5404 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f81bc7df-1fc6-472e-a0c2-d644c8043117} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:2248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7072 -childID 11 -isForBrowser -prefsHandle 5900 -prefMapHandle 7000 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee4184e9-3257-4053-8cde-948b59630efb} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:5868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7600 -childID 12 -isForBrowser -prefsHandle 7720 -prefMapHandle 7696 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4c77f5c-9aa0-4dc5-aeb2-16e945c94843} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7640 -childID 13 -isForBrowser -prefsHandle 7732 -prefMapHandle 7728 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c217a6c-4be0-4a60-9199-2b6e74140fbd} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:5952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7972 -childID 14 -isForBrowser -prefsHandle 7964 -prefMapHandle 7960 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77afa331-24f8-4f27-bff1-6b9640e0d977} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8216 -childID 15 -isForBrowser -prefsHandle 8224 -prefMapHandle 8228 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {600c77d4-c11c-4e63-95b8-681228c61174} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8456 -childID 16 -isForBrowser -prefsHandle 8488 -prefMapHandle 8308 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99581a87-91e6-4915-b7f6-a15d26474f96} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8308 -childID 17 -isForBrowser -prefsHandle 8600 -prefMapHandle 8268 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {883cc51a-56f3-4114-a1de-3299e7d8b3af} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7532 -childID 18 -isForBrowser -prefsHandle 7548 -prefMapHandle 8624 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5dd9dba5-9e13-425f-8c58-211abefd5c1b} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8960 -childID 19 -isForBrowser -prefsHandle 8964 -prefMapHandle 8968 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b355188-22f2-4435-b76c-83a9a89a84f0} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:1388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9200 -childID 20 -isForBrowser -prefsHandle 9044 -prefMapHandle 9168 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c80cf69-46d8-4a7a-ab49-ac3ca59b7499} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9372 -childID 21 -isForBrowser -prefsHandle 9320 -prefMapHandle 9364 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa1c4e16-2440-4849-83f3-a2954a02ab42} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:1536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9392 -childID 22 -isForBrowser -prefsHandle 9600 -prefMapHandle 9596 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a02278e3-25b7-4d95-992a-a7d33d7391a1} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:6556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9780 -childID 23 -isForBrowser -prefsHandle 9804 -prefMapHandle 10040 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fd4ee2d-7a37-41f4-a28c-22462e81c283} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:6724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10328 -childID 24 -isForBrowser -prefsHandle 10312 -prefMapHandle 10320 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04f0eae3-9649-4f84-84ea-5bed7218541e} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:6900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9244 -childID 25 -isForBrowser -prefsHandle 9252 -prefMapHandle 9256 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0481d793-42e0-4a4b-b56a-32a8bf7ab9d2} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:6548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8432 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 8464 -prefMapHandle 8420 -prefsLen 30582 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aecb501b-d387-4b93-b600-0e9bc5fe5d34} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" utility
    3⤵
    - Checks processor information in registry
    PID:6872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 26 -isForBrowser -prefsHandle 7004 -prefMapHandle 9260 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {901542aa-95d8-4cae-8e32-c0d701c119a2} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -childID 27 -isForBrowser -prefsHandle 10456 -prefMapHandle 9788 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b468eaf7-8f5c-4ec6-bf8b-2439fa088091} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5892 -childID 28 -isForBrowser -prefsHandle 5924 -prefMapHandle 5980 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1284 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85ee471c-6fe9-48d9-910e-cc5ce0dffde4} 4520 "\\.\pipe\gecko-crash-server-pipe.4520" tab
    3⤵
    PID:6072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1e54b2dd2a38b6b98a61f71a25d56b4b

SHA1
a74f0f903b28fc98989fe79ebc3b5146b5de4982

SHA256
45e85917a0c89abd894452e8b37c71fd31fcfe9376c67d4541c26d86729d97ee

SHA512
303aad03e013c6e9b7fe7424708359bd5fbb963e716c4d4e9612e0eecb0f6b6c0f626fba160b48f17f9c8086f78e8bef597222d74554b620e55f7dfcdeb4a7e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
643b72f5484b6ff717ab7b5a976912e0

SHA1
a6630a27e0060ae8b844e03dc71ff623c7ef3d55

SHA256
6d104aa252ff7aac6705bfa1301920826fba75037d1096c842239027acaaa167

SHA512
3a4e0f2515bdb77eca4bbf90f7441842d34dee0412bd0009dfe2fe47476a878014e50f1fa2337d13455434063c28738eeea6fb187fbadb0b2ac22160827d93cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
014688bda45a3cab3d30f653ec4a97f1

SHA1
eecdc672dc26ae183783474f387cd4ad1dda22d5

SHA256
98e6d19ce531f1fc996589a5ed26cfc9072ee3b4e98c8d9149d7b8c1626f369b

SHA512
624684bedf265dee008c77b4eaa63520c582442e15727b89d32bf145fa0c611449a1b7fffe6c4ca44e69c15297c27b721f7e8469414cba86239047227d7e3d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bcbd9783f6454b59659a840d2d6146cc

SHA1
41da304c6aa0322f0bb068f9f0a61b9003de8198

SHA256
2372b206a025c94080e3c2fff308506cbde49c5cf1e1533bf2cf0e5135d90340

SHA512
849c81d2f689c480c3463a89784d150a3d3e65a604e51b85d882030b44f41837e0e1c5e7baf5aede8a5ee5d4393d755a434114bc603639a825cca58ac923dc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86aa35610f84979519d9c4c4b1f0e19e

SHA1
55dbe6529b627b0916e74b539e264c099544901c

SHA256
9919f727825d1301f7371bd6e2280297d271d6255f1ff6908809ca2d7d39bfdf

SHA512
9b8b967fe73ac7067f7e49696aaef6007c4b0794ffadf53484ebc0274e252b777239b6808115f49cbbb89ecf1200ef0d1e1d1aa7e7ed51eca8d03b1343f35915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e454bf09709f8e70e24501bce39f317e

SHA1
781f74f5a302a5309c7061bdf13723f76f59d373

SHA256
1c9dc76b4b0a9e2a383688d6bc7440972be099c418f190b58896e6e812384ece

SHA512
00cc3c1a65a9e44a18fd276f2fbda4efa746f68ff64d166b68bd362bd67e0349fc3916b64361543f01649656dcb3bdd21fe1ce2c5c145113db210dc0b23fce1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
264ec2084e3999f8c4c757c63de131a4

SHA1
a538b859d29cd5b48ca9f882b52feba78e525e17

SHA256
53cb28ea73a7fb4534fbbe45c7f69c0053a83c48c2c13914379be2f4ec28a529

SHA512
063b21a8ad94e71b0c49e92b3b6ff85668d4861d9bbbafce451c4d86c3334361546c2f1c6fdc57da8e01efeb9fec72944cbf84028161d58b3ee3381edeba13e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5f701071347bdb0e80feec0d12f536f1

SHA1
d2735e678b7470639ed67c299e44fc38dae9e896

SHA256
de4b527cd7b409c24b6a4e1e6832628d6c54aadaec3fa11d3744860a14808047

SHA512
0d2baea3d1228061b657711c049228ce769bc27fa36acde3c3b0d1a1d45cc68b2f9a7e4669c9599b9f07fb30f6e9cffc5c3895b4c486eb2561a1141cab424e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6e932606f3ce4f1f458c51bd65aef8b

SHA1
bc276ff34bdd34401cd162277ab7a6d3c51eb611

SHA256
70cddb039fd139b0be05acfa74c6349a0687abf1a302a6f7c266026a45f084b4

SHA512
b97983fa189c719fc23b36527be1d0af8c3d80acdd850695ec2cce30aab7f2e89989ed744021c386dfa375abf8ffb9df5872c02097f5afbf6108baa5827b1667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
da8ac720604be942dc28212e2f2433ae

SHA1
d4fbfb0dfffe49057f66ca5aaa5de20c7ccadd9a

SHA256
c473df8628fd757c250da2247098fb670289ce21b33c17df67c4fc81d9ca8b26

SHA512
86feee19a4e7f05b619370d110d5842c3fbdf5f04ee20a08ae6bea13836a6dcaf7e1c680d87c34752204f2756a767d317f0302d0b7a9b1648404290f28aa172a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581a69.TMP

Filesize
1KB

MD5
bdcdfa918588cfd8428b5c85c91dea2f

SHA1
3aa9189b9dc9ff30ef2d79561294b3dcdf36925c

SHA256
2ee505601cb1c9f58384b5e99a051a01534d0db01de9f78d929e6a8373652d5e

SHA512
389a84cb46c321bd33a05831780d6cebc093b86514fe47c9ff3709a202dd642305e5dc9fbc61b963de24250829c5ada082873bf994249993034c441f78c96ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
62f5071308d712046e70e72969cf4a06

SHA1
fd3ee09e65c88a66e18e164014f29ebda07ba327

SHA256
a2fb52f339bc3446a126d83bcbf4626956702bacd6083ed6b253594a0c587f9e

SHA512
ca75d3f6a6a5b243a451e73b2fc67c0ca4114a949eb4f48c5689f52a34618cac55072e892588a192334157b574dd36b7786d42d86959bbd7b7cea7be4d7d7189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0d3c05ed39a003cc98d2ee2cda7b1117

SHA1
f85f068f27046e1d1f69c535ef19f797c6eed403

SHA256
d05f79dc5045ab351e6919d9879b989fec8df6b07f3c8653272fa3a5653eec1f

SHA512
369a099438be0a81997e4d0e79e834b9fc336e253321c51d29a194b38609b29b7dbcb303369d8159267c2ad02b749a4fd435c2ed40836f153eddd71aed9c61bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
869b9180565b37aea496da52f090097c

SHA1
957df95cfdcc8ec6ab9190de4cc1df9330b459de

SHA256
83029bb891b5d1bad67ec595f57e05fea292536cd58a5b781b93217bec003a3e

SHA512
3ba1e968727c6af75c3bb83384e4dd16ca7057e9c9022b62983a57375e9e201a547a5546cdeca4c6e0fd90b30dca8995c47ed30c8a90c139f59436d804516b7c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

Filesize
30KB

MD5
0235d9fa2cd7139a3a137a84579cf665

SHA1
feb12c737853e80e859e0cd62acd966cf30b179f

SHA256
ba5cd3b002c21a0ccd7e108c22402cd4c04fe728aa9da8ca0ab894e676639408

SHA512
055a83c8d028eb28fba081d2eede5f289eafc5166e598e372ee8c7ff330d235f11d8d1d2890448e04ff4496a6d66d955d40d7db2b09f25a518b567ae0c049440

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RLLHL.tmp\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.tmp

Filesize
2.9MB

MD5
61f123752ed4b5f496a7d42f3fc48f3c

SHA1
e8a80463e5e990d8bcfae02fa15e087fe6a066a0

SHA256
30c57f0703379ffd35d5a463a9fbd59205431f405140dfe7e09109a9f6d89131

SHA512
844914a6d99f5df38591a7869bb7999d094dba527ce1c65a5fd23920bc5faf7794a44de0639bcdea8b02076029e7e83508ad32d6b2f4367ccfcd891f08ce9935

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
8KB

MD5
4518f4094da61010041a13de991a6f4a

SHA1
80669525e14567c6b00a8af1a82c70bb76401ea7

SHA256
16796721a1fb2e15eeea030e0fb50c9e173878f7aa2335ca5db084896953fc0e

SHA512
6321a4aea48bb614ba603e3f6a3297e4445d51336eec7f1fc364200a2f9410129e1a35609e1ca294e74cb6a345cf24ab749690ddfce2ed240f4cb6794a0013f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ed2e8d8c53e4906ad942c48c51f640cd

SHA1
7c81e7fb1234788cbd3fde33dbc8fa80879c7c15

SHA256
d39a4cf2fe0dc30913e2ade86e1d902d293af2a86e5f03b6dab8e7f5546ecae0

SHA512
219d9bfc73eebe45458447bedf8e036ff8a19cad2c80be9adf73ee2fc641d89e7a24425e048a086f99bbcf2df3370a7850baabe8838343b684a0fc439066181f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c317f58802920095685a306e4fdfe745

SHA1
b854285ea8a457a3e35fc940e7d6d03729f7b95d

SHA256
1caeab81f5490a2e0b9546fec1b66367d6af11a3584261115b1e454096e1beac

SHA512
f489f232c51016aacd664d6053802937e587fa3e7e21c0fc3e209ad16e18bfbaa481685c9a901a99105d75ebcfc60be87d1d1207bf483478feec795725261ab4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\6faaeca1-b595-4f94-adf3-49b807dc8a38

Filesize
982B

MD5
c6a41f678c3126e7ab68a946fec96a8b

SHA1
e3090c0943ea89d6be799e60a944cd282d4c17a8

SHA256
056dadacf3fee34b6b28b45d9364e87a6d8a34d8273b0326cf92f0d6c315c51b

SHA512
23383299114498b532dc5644505f1fe84e8ca4765d38a046a5779758ba031a1f6f8daeeef4556d01dcb212e7af55928039b67607ded6dc9355600c6a51ce2d7d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\8ea6e1a8-99ba-43e3-af6a-da69633447b3

Filesize
27KB

MD5
cc7c533ae7797d0e663d5a9c0c7352e9

SHA1
0b9ef02650594025390facc17d6227724f8eed1b

SHA256
8538a341014f0b3bf6bea42059e18d5e37ebd891eca23eb5f4cd9a633488f83a

SHA512
a59625a35852a89e0c3bc5218941144dc749cfa2b3acaa8926bf458d867a1c8f7fe5a87979a76d22d0d15b20c93c5271f5348bc8574ef45ee01d3b07e4138ccb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\ce57c42a-d010-41a1-bd4e-b836a1b5bc7c

Filesize
671B

MD5
84effdaa96e62331e567fb88f5454147

SHA1
9efbb6c6abd92e8e6a19b3c6a587a5a33072716b

SHA256
bd3adf37722f9e5b19c32e670eef7ae08c3313fe03904f5a068062d5c9047c91

SHA512
9e8266bdcc18d262029657b4ed0fa1324963c372d73d809fa80825984952135e76d2efea5a83ff146cb3fcd043d49b7ad4a259823ff2f1ba8e946ff5b49557b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
11KB

MD5
c79c88dbc90ac2d9a42234a1fd8dde81

SHA1
6b94605a43cbed980a119ac8c20a875ade9aee38

SHA256
da004ffc896aa2da5e7fedb57a6e708dce07b4c93c223e82ed5538ad4f1ae02c

SHA512
2f01b0e4c92ccb935b4220e24d819bb90c877fbe923d2caf2888f74064c123cdf799746b87c5cfe6fc050460480c378eb4a534e95bd951689730df8ab25a6ae5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
10KB

MD5
341b5bd3b3a0d19e20dbe744592a20b0

SHA1
8fa0c24bcad064f2050393a88309cf0512174980

SHA256
8fec7497851cbc46203b19c1e9797618846d26a1ee672590961d5708d2281570

SHA512
05757c1c434461305e757414d71a3dc90e8e4e9a9fb3323c9817fe376cbfa01a7964a71faa17e09c463207c5a7f10c42018ce753f300485ebc58fe1f7b76bf94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
3a1fefcd1f999a17807bc717f40704ed

SHA1
529db974536c8fa356a3aa4909e11283d9f24ed5

SHA256
73e5d87b3066b1244dd26f434c1ba36536c7b77670890ff5e0ac78d979bb2aa0

SHA512
e171e9ce5b482d363ea7949e06ada2a03d4f7065e58630fb2ce768ae72d96a116e7c312b3bf2503ee7e2a6116f8abad26ecb729ea34d0aceb5ee36debcf241c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
55cf82582760c05c918ec8b450c6471a

SHA1
3093351c0a06c0e8e8f74005f52c183debeb503e

SHA256
5ade9fe0a895a5396da17d02380ccf23297e7873b9fd4b743ef5b2b3997009e7

SHA512
d35bd503e32adede95801ef905efd23947c86954590dd79bf1b549c343f6fcbc4de5385e2aac99ca9d761adeff7f70f9d7a38ca85346103016eafae514a966b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bb5f3426150591351dab9806fa3e89f6

SHA1
ad8ec58f50a4caae3640f68865ea93188504fc6c

SHA256
887c7333ad403eadc32dbada3c09a134b91188be03453acc0db0c6db2d1c651e

SHA512
a953412f312237a88ccf8670ccf472e33bf071f03ae29177261410e7c5070508c68f40c81e72350fa060c1a9078a50bddc94a9a4dcba9d8d1d7b547fee34e99f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
fc3d3192f09fae3f5f15ee8d846e6e6e

SHA1
ddb8f7765750f12ece9dcc31b8b2359ce58e90af

SHA256
40801ce71882722326e25122323ae557dfbdc5ae2397d82be38395c3521b2b46

SHA512
7d76fb063b5f257dfa7fbe91ab13243a7215443dc89b5a4b39c9ba2625e4aa0b4595d7e89236287e2b151b83087471806629909f6b049cafde95bbbdcd4edabd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
5b635a76d40df88119383a436cb036e4

SHA1
f2e618887b21f7c5fd81830862cd9e022bc52c1f

SHA256
a81515796b423c75aafe638f4497772afebaae9f58530b973da0133744a70efc

SHA512
f77c9b1237599953480997d4fc8df1ad62a8c4b4243f1cc41a75c0399be7f934c2b969711f8176b095ebe5a6780338c5042dc0e9247689a5fadd7ecab5ffa454

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\111\{f30ec3e0-7564-4629-9a57-cbf3d213166f}.final

Filesize
766B

MD5
13bb7cafbb20a6fa9f4bc3ad8c6f445f

SHA1
6213a897213cc032762e499bfd0fce811c455e05

SHA256
424b5bcbd11ddb43282b3d0041b1664d12992994116ce6e473a8679e18043874

SHA512
b6c8715b80b32816fa1512a0ce86f8a4583d54f75a118e2b17f07a757a7012601b77a4ea3e0cc33fbede46d12780376a0616aabb71330973005c89507acf4da0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\114\{aefd5c9a-e6c2-462a-963f-bcddb332bd72}.final

Filesize
914B

MD5
42be2d91dc1832eaf1260fa229a36e5e

SHA1
8a9705fbc8e6b1d239e4830b985b446e8ba82824

SHA256
586ec9b20c107b3bc831af9a3999e6b040b13c0c140ac10dcbb150fe7e724c11

SHA512
ac5ba80bf723afc86efb632959236de0563bfc5425bdec4cc0039e38aa8c50848159577b1d7229da82d726cd93d069dd12e47c41378ecd5e51cbca2808b4e808

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\122\{3aab2414-8382-4d37-9be6-076f31c9337a}.final

Filesize
1KB

MD5
1ca3cf57769dcc70bc5b5bec5f472f2d

SHA1
dcad2370499395ff807e5f2bbfab69d7255b0099

SHA256
82f8ccbabf81006933f2b4a212dc45521bf512ae513ffa04140a776753f52be4

SHA512
6d016cfe9586dc6926c6d93b704949b6e12bb9ecf1b09da83e085cfc4661577b718376fb8771bbf5c5df4c75aca0fc8df55f7314e45efd33e6b95e5e00a9ca2e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\166\{7383be21-3c63-4571-968e-70567d7ed2a6}.final

Filesize
463B

MD5
7004f20cae1adb3acfd6a2e66a249d67

SHA1
74f91d638a7a974894bb0502d62638f56b2e57b9

SHA256
8f503fb7cf36105221e29684674f9da176ae85019b82e889e70ca3f181803af8

SHA512
1b10acea9bc2ab27bc9644410439136b56af3a307b7b5f1335039b54603a78b4261685b14fee86b4572a0067c5b13218f0c6eeec9febdaf6c349db31447d9bf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\173\{b8661332-dd2c-40be-86b8-27345a1e70ad}.final

Filesize
889B

MD5
a7da4cb90c13baf8d8e9eb051ccea9e0

SHA1
6120025c6820a5a74ff71966e521bbfa66c8f5dd

SHA256
8b362cb4f00aac3423dc90d28871105d2436600b0ff8ad8309ff9296a826e692

SHA512
962f166a9658623a4dae5fc2d52b0c40472a3648b37d62629c96150fef28fa4f02ebdd7ea62529da9715d054f2f1f6eac9194bb0b501c2500595c2287cf8d8ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\187\{e8ad45f8-52d3-4d62-84bb-4a7793456abb}.final

Filesize
31KB

MD5
4bfe8e77bd1310f663096697db87ae6a

SHA1
46b2e8c8ae0d646535a4dea56070913cf354ef2f

SHA256
85dd75f0fdea3b8a116f833fd7a44f24844fbbcddb01f444d445e3461d46ba88

SHA512
3bdbd35512cf5fbf1856a3ba21fe2dbea03ea36480ff5c6efc35eaad703319daf271ff4c81198a1796e7f96f2a058a9c7d79187f88322b6a9ccb2557f5e212af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\203\{3c8f6efb-6d36-44a0-85cc-1973768aedcb}.final

Filesize
1KB

MD5
405b669e8079d96f7bcc412bc1c2e9b8

SHA1
708cbb4f6beee3f4d5f0d371b081c5c251601fdb

SHA256
19c8781adef7b3758fc70b15072ad164095d8b7bc6f30de8e5919283b83d140f

SHA512
4dfbda91b86fe59b77bbfe1ae4d193b6677d1d6c9bd25f691da0c05b60c25d1d0d2aceee347c3324afff7e7071f2810f74742752407fbc04a0cf247c359815ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\218\{952e850b-3ceb-4248-a6ee-de6d2918e3da}.final

Filesize
231B

MD5
6de7aa303cf9221ae762ea40bdd4c2a3

SHA1
4d78038733358dadfc4d99a4e06547fef2480c12

SHA256
fa7935dbd66301c7c780ae92563943fdbdb04ee0b1a1641f30c008bfdb174f85

SHA512
468a77dfcbf8ee2257b1dbf8246977de7405631fc821579cb1c30b68e2f19bd8eac77ba4a2c3900e64e16cb10253781caa0346b972b547d495295563662ecfd8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\238\{e569149a-cc39-43ea-af73-cfb2954f6eee}.final

Filesize
337B

MD5
b46bb855075541f60eea8ad442f517b9

SHA1
ca4373bc0e8aed3b7b02ed851aa72ff40680b0eb

SHA256
a97b85742818490272f85519dbe775243b9c2fd83c0fdf7d9577ff1a8b6721ae

SHA512
8f788d7d00f20881c3066cc1ddfffc82abcdc0702ca004b0614a67ef935ea3ce7a74a87a2882203d86a273a69cb7b2cca8bfad7b0a0b6f546d75a3c8b274d7b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\23\{62cc4e8b-aa19-4dc6-a63e-2da4b6812917}.final

Filesize
428B

MD5
bd0fb6c22ff19f80048e77c6eef33bf3

SHA1
bd9c8294f218dd922054d89698d189d377a9df3b

SHA256
54e87ae167f0372aab65ac65d6c69328bfc5e8ff440b3855852323b9e83d8b93

SHA512
c35d77cbe3b5408b6c68d782e0f78bdce1c4b801bff7156f67a1589e8573a8da9582f8c20351c105595d3d46a116c72e9acb2bbf8ab805c33120ab6d0ba95ad0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\default\https+++send.vis.ee\cache\morgue\91\{780ba6e6-7c48-4fba-b26c-0c71cd74665b}.final

Filesize
496B

MD5
a60533e1a43b07c7b6b5d026896fa7d4

SHA1
a9eff8cfba426a21a39f4fc2f1078bb6e41a915c

SHA256
c2be993a36460471113c9c1c60b146f08591b34a033e62cde1f4a97eff18c639

SHA512
66fa58027edc3f8b371d80e8a4cea629bb81837c6437e756266418f900e897e052cef7eca4ea8ed87b71c79695c427914c8a3ce99226eecb24da435fe4078279

Download Submit
C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD.rar

Filesize
32.7MB

MD5
196402b1a22cbf412870d3dfa93f7f88

SHA1
7078241622eba22736d20d4e935222c1878a4f88

SHA256
d634fa713cd01106a8d417519881671c3232dc2e02e942298cd9610bb1617c5c

SHA512
2cdb222874a61b205ff774b48e4ee8879229270a34aa0f1120dcd04e850eddf209bad7308da17d47bf24fd8012ba65267c52c6bcddaeb363e87f8b29ca273f10

Download Submit
C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.exe

Filesize
33.1MB

MD5
3b98aaf495a4fe74781f5f319c705acb

SHA1
b951c5cc0906c9575de5ee7b0677c5b993a2320b

SHA256
38aaa2a63c2bbc8338c08cc05bf1d47efe1065fa72a214e2310ce217fbe5691c

SHA512
ee00471e20181592e9408b1fc76461860449fd322c7fd72f5f9f506e29d8396442df9216b781576e7d7a0ec77e52f228b4f868809ee509ef4f0e4fa3b7ffd521

Download Submit
C:\Users\Admin\Desktop\FabFilter Total Bundle 2024.5.30 WIN-TCD\FabFilter.Total.Bundle.2024.5.30-TeamCubeadooby.nfo

Filesize
404B

MD5
47f6eb39de190213d8ce13990605cac8

SHA1
f433af6c455922d259305b88b58930140dff9f43

SHA256
aefd7a115ecb254a2a550ea505e80e48d7422849069f639e7cce6f9db25bdc91

SHA512
572c68bd135e3925ba7c6581b977c03a779e8096d28ee93ddd4692ddc1ce6685d300ec14f203a158da71c408b4c922bfdb2c5976d2b3b39d2af328643af52b85

Download Submit
C:\Users\Admin\Documents\FabFilter\PlugIn.ico

Filesize
22KB

MD5
e3d495b5f293e8e2f424999d79d8c244

SHA1
b1a997ccabb2f4ad77299a245e866c2982af9c87

SHA256
620b2446c613da1f6d3bd76920d3b4a27fae68ef37179258b0a73e35043fe2b2

SHA512
81dc883c22afa44843b589bfcf5515cbfe0b4fe3c5f1b2185673b84126644003b408906d319c678101774a17784388aedd952dbcaafcfdc5ed109fd6df84faf3

Download Submit
C:\Users\Admin\Documents\FabFilter\desktop.ini

Filesize
48B

MD5
3fd9a457e4fb03c9dfc15b7c2ee46385

SHA1
7aecb0ff07a387eeda70b80efd260d9d71b52e0d

SHA256
0121b3869435f9c6ffcc154d6977b05b22695d83beb5ddd433d34226ecd5c7c5

SHA512
323228e47052ad7fd017ab19f0515456e31f0f022b079dbda45e735b8e1d601cc69476b84b6656d5645beba7aa919157c401346daada10b990824088fe3a9913

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 942215.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
memory/236-686-0x0000000000400000-0x00000000006F7000-memory.dmp

Filesize
3.0MB

Download
memory/236-668-0x0000000000400000-0x00000000006F7000-memory.dmp

Filesize
3.0MB

Download
memory/236-723-0x0000000000400000-0x00000000006F7000-memory.dmp

Filesize
3.0MB

Download
memory/5500-724-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/5500-661-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/5500-667-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download