5513812584a5ba7810b812db7ceec2d0e9cb214cef95a2580e29927cf4fe9921

Resubmissions

02-11-2024 19:04

241102-xremnaskgy 7

02-11-2024 19:04

241102-xqyddaskfs 8

Analysis

max time kernel
1686s
max time network
1427s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
02-11-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/FindProcDLL.dll
Size

3KB
MD5

b4faf654de4284a89eaf7d073e4e1e63
SHA1

8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA256

c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
SHA512

eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\ahcache.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\videoprt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\disk.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidbth.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mountmgr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pcw.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\sdstor.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\HyperVideo.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mausbhost.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxsmb20.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ntfs.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\kbdhid.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vmstorfl.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ipnat.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\SDFRd.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\Microsoft.Bluetooth.Profiles.HidOverGatt.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\intelpep.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\npsvctrig.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\NfcCx.dll	cmd.exe
File opened for modification	C:\Windows\System32\drivers\agilevpn.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mslldp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mrxsmb.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vmbus.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\gpuenergydrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\srvnet.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\WdmCompanionFilter.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\BtaMPM.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\BTHUSB.SYS.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\pnpmem.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\dumpfve.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\ndis.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mssecflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\mrxdav.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\msiscsi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\hidclass.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\rdbss.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\bthport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\HdAudio.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vwifimp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\appid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\nwifi.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\storqosflt.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\battc.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\processr.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\kbdhid.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\lltdio.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\USBXHCI.SYS	cmd.exe
File opened for modification	C:\Windows\System32\drivers\vdrvroot.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\devauthe.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\wmiacpi.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\USBAUDIO.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\volsnap.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\mssmbios.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\pmem.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vhdmp.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\ataport.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\en-US\vdrvroot.sys.mui	cmd.exe
File opened for modification	C:\Windows\System32\drivers\raspptp.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UevAgentDriver.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	cmd.exe
File opened for modification	C:\Windows\System32\drivers\raspppoe.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\UMDF\en-US\Microsoft.Bluetooth.Profiles.HidOverGatt.dll.mui	cmd.exe

Manipulates Digital Signatures 4 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll	cmd.exe
File opened for modification	C:\Windows\System32\wintrust.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	cmd.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File opened for modification	C:\Windows\System32\spool\prtprocs\x64\winprint.dll	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\AM4B4E~1.435\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM73FD~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3600~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM031C~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM26C1~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7F64~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM52EB~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1A03~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM0A9A~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM82AF~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM33F5~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC81E~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM066F~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM3CA2~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD8BC~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5D45~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM91A0~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB161~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME369~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM60C1~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMB420~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AME3F0~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5007~2.435\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7F8B~2.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF414~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA417~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6E1C~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA114~1.423\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD8B8~1.1_N\desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM10F5~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2651~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMBA5B~1.1_N\Desktop.ini	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM1D91~1.447\Desktop.ini	cmd.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BITLOC~1\autorun.inf	cmd.exe
File opened for modification	C:\Windows\WinSxS\X85378~1.1_N\autorun.inf	cmd.exe
File opened for modification	C:\Windows\WinSxS\X86_MI~4.435\autorun.inf	cmd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\en-US\azroleui.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\dsreg.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\XInput9_1_0.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventNetworkAdapter.format.ps1xml	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\wldp.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\setupcl.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\SyncController.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\mmc.exe	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA435_olpc_LE_5.bin	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\usbaudio2.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\en-US\bthudtask.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\LanguageComponentsInstaller.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\XInput9_1_0.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\migwiz\replacementmanifests\DHCPServerMigPluginWin8-Replacement.man	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetTCPIP\Tcpip.Format.ps1xml	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\nett4x64.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\netlogon.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\dinput.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetworkSwitchManager\fr-FR\NetworkSwitchManager.Resource.psd1	cmd.exe
File opened for modification	C:\Windows\System32\cflapi.dll	cmd.exe
File opened for modification	C:\Windows\System32\de-DE\APMonUI.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\es-ES\uefi.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\glu32.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\hdwwiz.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\Dism\es-ES\AssocProvider.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\iastorv.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\wave.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\iasacct.dll	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\nshhttp.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\pku2u.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\kmddsp.tsp	cmd.exe
File opened for modification	C:\Windows\System32\config\TxR\{5AAA2~1.REG	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_1daeee8f3aa30fcb\Amd64\TTYRES.DLL	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\AppxPackaging.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\config\BBI.LOG1	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_6360d736a6f64e35\mdmdgitn.inf	cmd.exe
File opened for modification	C:\Windows\System32\en-US\fveui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\dssvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\MSFT_FileDirectoryConfiguration.Registration.mfl	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\PeerDistCleaner.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\AzureSettingSyncProvider.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\wlansvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\query.exe.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\console.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\getuname.dll	cmd.exe
File opened for modification	C:\Windows\System32\en-US\fsutil.exe.mui	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\assignedaccessmanager.dll.mui	cmd.exe
File opened for modification	C:\Windows\SysWOW64\ko-KR\SyncRes.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\netr28ux.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\es-ES\AppReadiness.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\EventViewer_EventDetails.xsl	cmd.exe
File opened for modification	C:\Windows\System32\tapi3.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\eappgnui.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\uk-UA\assignedaccessmanagersvc.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\netwns64.inf_loc	cmd.exe
File opened for modification	C:\Windows\System32\it-IT\dhcpcmonitor.dll.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\kswdmcap.ax.mui	cmd.exe
File opened for modification	C:\Windows\System32\ja-jp\secpol.msc	cmd.exe
File opened for modification	C:\Windows\System32\rometadata.dll	cmd.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\netrass.inf_loc	cmd.exe
File opened for modification	C:\Windows\SysWOW64\mfc42.dll	cmd.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\StorageCmdlets.cdxml	cmd.exe
File opened for modification	C:\Windows\System32\BitLockerWizard.exe	cmd.exe
File opened for modification	C:\Windows\System32\fr-FR\smbwmiv2.dll.mui	cmd.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File opened for modification	C:\Windows\System32\termsrv.dll	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\COMMON~1\System\Ole DB\oledb32.dll	cmd.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\uk-UA\wmpnssci.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\UEV\INBOXT~1\MicrosoftLync2013Win64.xml	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\MID56C~1.XML	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\E2A4F9~1.423\S-1-5-~1.PCK	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldMatch.snippets.ps1xml	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\keypad.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WIF4A9~1\SenseCM.exe	cmd.exe
File opened for modification	C:\PROGRA~1\WI54FB~1\de-DE\wmpnscfg.exe.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WI54FB~1\MEDIAR~1\RenderingControl_DMP.xml	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\it\UIAutomationProvider.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.ps1	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\en-GB\tipresx.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\TabTip.exe	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\it-IT\wab32res.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VGX\VGX.dll	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\Simple.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI11D9~1.102\ACTIVA~1.LOG	cmd.exe
File opened for modification	C:\PROGRA~1\WI54FB~1\es-ES\setup_wm.exe.mui	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\WINDOW~2\MSFax\COMMON~1\es-ES\generic.cov	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~1\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~3\TABLET~1\TableTextService.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~3\TABLET~1\TableTextServiceYi.txt	cmd.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\NCSIUW~1.XML	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\WINDOW~1\Definition Updates\Default\MpAvBase.vdm	cmd.exe
File opened for modification	C:\PROGRA~2\COMMON~1\System\Ole DB\msdaurl.dll	cmd.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\Ole DB\sqloledb.dll	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.ComponentModel.DataAnnotations.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestsRunningInCleanRunspace.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~2\COMMON~1\System\msadc\en-US\msdaremr.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\es\System.Xml.Linq.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat	cmd.exe
File opened for modification	C:\PROGRA~1\WIF4A9~1\CLASSI~1\Dprt\Microsoft.Ceres.DocParsing.FormatHandlers.Common.Configuration.dll	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\es\PresentationFramework.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fr-FR\InkObj.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\It.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\ja\System.Data.Services.Design.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\ipskor.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WIF4A9~1\CLASSI~1\Dprt\NativeDprt.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WIF4A9~1\SenseGPParser.exe	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\System.Runtime.Serialization.dll	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\UEV\INBOXT~1\MicrosoftOffice2013BackupWin64.xml	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\images\bing.ico	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\ContainExactly.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Microsoft.PowerShell.Operation.Validation.Tests.ps1	cmd.exe
File opened for modification	C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\1527C7~1.102\ACTIVA~1.LOG	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\th-TH\tipresx.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\ja\PresentationCore.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WIF4A9~1\CLASSI~1\nl7models0804.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\CHANGELOG.md	cmd.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mraut.dll	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\ado\adojavas.inc	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\msadc\msdaprsr.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WINDOW~1\ConfigSecurityPolicy.exe	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WI54FB~1\de-DE\WMPMediaSharing.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\chocolateyInstall.ps1	cmd.exe
File opened for modification	C:\PROGRA~2\COMMON~1\System\Ole DB\msdasql.dll	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\de\System.Printing.resources.dll	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\nunit_schema_2.5.xsd	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\5.css	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMAD61~1.746\r\MEDIAF~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\X86_MI~4.616\MFC90DEU.DLL	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\pris\resources.ja-JP.pri	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM00D8~1.363\MQUTIL~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM8F60~1.363\f\LOCALS~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM43B9~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOW64_~2.116\f\dciman32.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO89A7~1.102\devmgmt.msc	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO0FBD~1.435\r\TRUSTE~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMA728~1.423\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC464~1.363\C_28597.NLS	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7E77~1.435\f\MapsCSP.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM940E~1.1_D\STORPR~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOBC19~1.120\r\WID74E~1.WIN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO8947~1.435\f\SYSTEM~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMC945~1.447\r\WINDOW~1.PRI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD493~1.0_D\SYSTEM~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$8845~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMC77F~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WO07AD~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO173B~1.435\r\Netplwiz.exe	cmd.exe
File opened for modification	C:\Windows\WinSxS\X8E8E2~1.1_N\DEBUGA~1.RES	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOBC19~1.120\r\WI044C~1.WIN	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\controls\hubControls.js	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM7147~1.1_N\mdmati.inf	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMF9A6~1.1_D\http_400.htm	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMCE4F~1.363\n\PRINTM~1.MFL	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\$$C481~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMB0ED~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WO4807~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOA91E~1.546\miutils.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM6562~1.423\APPXSI~1.P7X	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMEDE2~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM6D9E~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOC0B3~1.363\winshfhc.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM23AB~1.1_E\KDSCLI~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM41BD~2.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\WO1EEE~1.MAN	cmd.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\oobeprovisioningentry-page.js	cmd.exe
File opened for modification	C:\Windows\WinSxS\AMD228~1.363\n\ASSIGN~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5574~1.363\DSREGD~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\Catalogs\38323adac4c56d718163e46ea2ff6d68e6a1fd1246ba85e6d89bd1222123429d.cat	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO32F7~1.1_U\ActionCenterCPL.dll.mui	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOD5C4~1.123\dispex.dll	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM07AC~2.MAN	cmd.exe
File opened for modification	C:\Windows\Speech_OneCore\Engines\SR\it-IT-N\r1040sr.lxa	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM12F5~1.1_J\MICROS~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\FileMaps\PRF501~1.CDF	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM11D0~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMFFDB~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM5810~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMD7E5~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AMF263~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO24A2~1.1_N\DHCPCM~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOBF78~1.435\f\NETWOR~1.DLL	cmd.exe
File opened for modification	C:\Windows\servicing\INBOXF~1\metadata\LA5F5B~1.MUM	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM5007~1.435\f\APPVST~2.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\Backup\AM8818~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\MANIFE~1\AM3F63~1.MAN	cmd.exe
File opened for modification	C:\Windows\WinSxS\WO21D4~2.435\f\CERTEN~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM4E5A~1.363\f\MSTSCA~1.MUI	cmd.exe
File opened for modification	C:\Windows\WinSxS\AM2972~1.1_N\MICROS~1.DLL	cmd.exe
File opened for modification	C:\Windows\WinSxS\WOW64_~1.0_J\cscui.dll	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	524	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2244	PING.EXE

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\Total = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "1"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\NumberOfSubdomains = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchApp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2244	PING.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	firefox.exe
Token: SeDebugPrivilege	3548	firefox.exe
Token: SeDebugPrivilege	5608	whoami.exe
Token: SeDebugPrivilege	3548	firefox.exe
Token: SeDebugPrivilege	3548	firefox.exe
Token: SeDebugPrivilege	3548	firefox.exe
Token: SeDebugPrivilege	3548	firefox.exe
Token: SeManageVolumePrivilege	2984	svchost.exe
Token: SeDebugPrivilege	5216	SearchApp.exe
Token: SeDebugPrivilege	5216	SearchApp.exe
Token: SeDebugPrivilege	5216	SearchApp.exe
Token: SeDebugPrivilege	5216	SearchApp.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe
3548	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3548	firefox.exe
5216	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 524	828	rundll32.exe	82
PID 828 wrote to memory of 524	828	rundll32.exe	82
PID 828 wrote to memory of 524	828	rundll32.exe	82
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 4848 wrote to memory of 3548	4848	firefox.exe	112
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 1260	3548	firefox.exe	113
PID 3548 wrote to memory of 3824	3548	firefox.exe	114
PID 3548 wrote to memory of 3824	3548	firefox.exe	114
PID 3548 wrote to memory of 3824	3548	firefox.exe	114
PID 3548 wrote to memory of 3824	3548	firefox.exe	114
PID 3548 wrote to memory of 3824	3548	firefox.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 600
    3⤵
    - Program crash
    PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 524 -ip 524
1⤵
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:824

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1848 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a7664d6-a976-46e2-83d8-fcb62f3a566d} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" gpu
    3⤵
    PID:1260
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2364 -parentBuildID 20240401114208 -prefsHandle 2332 -prefMapHandle 2328 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db28dd99-32e1-4829-9214-b6c5461a91ec} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" socket
    3⤵
    - Checks processor information in registry
    PID:3824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1280 -childID 1 -isForBrowser -prefsHandle 2888 -prefMapHandle 2884 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2efb1a5-947d-463c-9531-2027cb09bd3f} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" tab
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 3960 -prefMapHandle 3956 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53dae337-1d80-4a21-9f0a-e999872fe433} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" tab
    3⤵
    PID:4528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4872 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4864 -prefMapHandle 4860 -prefsLen 29198 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67fd7abc-8f87-4106-bfce-dfb38d6bdb92} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" utility
    3⤵
    - Checks processor information in registry
    PID:5532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 5548 -prefMapHandle 5544 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cc03df1-66f9-4595-a888-a41310730f3b} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" tab
    3⤵
    PID:6124
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5564 -childID 4 -isForBrowser -prefsHandle 5560 -prefMapHandle 5556 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88368961-20fe-4323-8c13-9cd3d3c91d59} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" tab
    3⤵
    PID:6132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5796 -childID 5 -isForBrowser -prefsHandle 5692 -prefMapHandle 5548 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22b5b0da-74c8-4fb6-86fc-ce1f9fafd97b} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" tab
    3⤵
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6148 -childID 6 -isForBrowser -prefsHandle 2720 -prefMapHandle 5796 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c026095-bbd6-4da0-9cec-5618c2cfd0e1} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" tab
    3⤵
    PID:3032

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5260
- C:\Windows\system32\whoami.exe
  whoami
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\system32\PING.EXE
  ping tpkxkbfb
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2244

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:5236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5216

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:4596

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:5560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\ACTIVI~1.JSO

Filesize
22KB

MD5
9ef7fb330affc0fc32427e6e6c3c69fc

SHA1
e70577968c6eb8fd974561e8b01f75148bc5cdc6

SHA256
de12321f2b05d1d0cbfcc679e254a6827c1917e1405531f3765f7f73992d29a3

SHA512
d2b96d8b3f26dde2ff34be94bbbff139271ceddab1bffef3281911924e337260c6250c7e71a5bd96d1bbbdbdfe7d89323968bd7c9520c60679449e491cdefd23

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0027D2~1

Filesize
11KB

MD5
4b2d54a04f3e926e86bf0f2a8ef30d0e

SHA1
16dc326751132082784688b45b5b4145947b0199

SHA256
52cd3b29eed7756c51b9d4578c227eefd90fd59d184ef767f830dcf203cc12b5

SHA512
2ad72ccd4d0855cad2de2d83c72ccd88e9c829ad5ae486783659c8a46b3f12ff3d26e52fd0a9a1fa82284b09ebd7e2fe38e37e7eda687ba4af9ba3bb71589ddd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0058C4~1

Filesize
9KB

MD5
e357feadddaba625a883ab46a26f4a39

SHA1
fbc8c2ff986fc71aaf81dc3fc13245c49dec32ce

SHA256
6ca2652929438ab469f1165319797ff9f44ce64c6c747e6999f53d92981ed3fa

SHA512
452ec3fdd974a403497a55d59835bbf17259c89e7f039fcf06afec897d670d07d6935797542c2d5f3d1c3b1d4843b6226b4a5c3c28846e53ff22ea5b9a55d70d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\009186~1

Filesize
10KB

MD5
082af85107c6455648beb538a1a8e8bc

SHA1
cadb1c18f897aab6205bb3a435a67cd4a4fe5889

SHA256
2697d0a1699e378dd2971d99ecf530f082f896298a02b84fcafe97a2f8c1d79e

SHA512
b2cb172a430b39289e28dbefdb5a9e44b9068ff76a445c214020623a39350bfd4e39a1d952d7618388f4f7dd19a19ded7a6e761363495e9879a1ef9e67f316b3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\00BB77~1

Filesize
10KB

MD5
9114c7c988951805bef32b5881346d18

SHA1
75111bafc1fb9439fe067e730408ddb93cb0328d

SHA256
92d5be0aed7b580a2ba7e836df683814d1e1695521bf09c17cb07e0601cc30de

SHA512
89b8827b24b3220e55de062ba63e54a4ce06644abf6f35451c09676442d6f2102857457320e5159db4076bef3388e6476dac76b2531c374db58d267b07cd5c5c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\00E483~1

Filesize
10KB

MD5
7c228684da70915f834af777e363c0b1

SHA1
344c9fad4c23c8292fa1cde5ebb0d63aed1dc4b0

SHA256
a5e2b2a9654d72d26edc9779eb77591817310773c6983188d59b95bf9a5f9440

SHA512
ea005e45b919c1bacdf637e978a92de5bdcdf6adbc6021f718da0a05d0b5ebb5ce34058f48a2617a2a4ce868445d0091b4c326bd08743aac96162769bda0bee4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\00E796~1

Filesize
11KB

MD5
d79e6ef0676e00cebb79588e71a3ea51

SHA1
0cf7cf67732c3e72414aea818c6680865dd09af6

SHA256
9873554bd276c693916926354d6746be7a23da432d83abf5f8c97b4b3b074d6d

SHA512
170e5238f0d4bc76df70053726ad7872b206a57a3d2c5526d0433164ca72bb850849f6e45439d5d30ed9997a90219e66d8e09e8212f2bae1166a1c3a41fa53cc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\00EE82~1

Filesize
10KB

MD5
04e1af92891f89edda33b78127e177e1

SHA1
93c546d90278667aec1c4cb20adb86a1248a771e

SHA256
ee7b7648ae2837a5f8f567fd32c0ccfe46fd261f6d399b8e5049245fc2d8bda7

SHA512
61ff09e6b79ef1cc65f25fac610897e54b399e47afffb6748ce095b2eda39c6e9f688c33b4822aadd5fc4c0557419693b9cbaf5c720c5d47e670031c11cc5ce8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\014C98~1

Filesize
10KB

MD5
a43b5f06db6f6582c8f34a5c226e0a4e

SHA1
3d18831185e1e7916aa9fdded365dc017aefac06

SHA256
711b78996065b552a32342f88f814875b144d5fc57839ff71dc7095be9995239

SHA512
f5312f385c218e7a785552e005518de510e0b407a3813ca07b6a11090453e68730ef6050a846acfb32a0eaacb03306351ee2629782aae8533d8f9ece42c444ec

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\017BE3~1

Filesize
10KB

MD5
5a7283a899abe5b64e988651979fddb7

SHA1
5191322aa0b850abff8fc4c5b68b3bdf4c8c4be5

SHA256
eee2315a92eb2beac654f9ce6c8a44cecf09f1621261d6df8ee4820a04a3f3c7

SHA512
3fc1a36f813d7802714d734c89454ab66563e1dd4d705f53f8687028d64da89336645b39d3293f5c09e20c4a4233fca3a7b86f148da39477a347031c10c06918

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\01AC70~1

Filesize
10KB

MD5
2649f789974f2252459cf792ec8c006b

SHA1
a49f0752b4b772d6c642c8212ea5bc88f4d905f2

SHA256
b66960f3a18ee853008683e14e82b742219bda7c41b634f3450a420c7f4ca176

SHA512
4cc8ada35f8d709930d6a96d3aa8a524bbec62c11818028b4d0f676bdd8ee7f6e958514e6a2f48bedfd41e52bbf081f3741aaedd4a5636f57d20e007c2c3ac99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\01B277~1

Filesize
10KB

MD5
18e4bc208ab356f3cf05ada047f9b532

SHA1
6e22e98d1d6aff7af1959a99303cfa02a1dbea3a

SHA256
def729215ae8c92916afa7c39b46a37ded789ab78d101f98296d1d8187be4a7f

SHA512
edd508fc540c628fdb71ca0459eb456e230b1e6ea03a56e9a3494d3cc333fcef49c4e883ba2cb20c788979b61bf3bbb4cb85d1c844e4f07dfb1455fb4b6a41e1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\01B324~1

Filesize
10KB

MD5
056adc2a267536c13b2093ec0a91953e

SHA1
3214309757d5e1545c29fe7118132500f691f01d

SHA256
e0c9cb425d5574e40445b79967edd58b86fa78fd094cfb8574b23c4a92e168f8

SHA512
f9a90b4fee733d999602984bc1d4d32f6753d21d5295d0388807e1613c453316592d8a6a1a2aa73e58368501447b9f14c8d371c8f7cee97548ce4d1b7b571eb2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\01B788~1

Filesize
11KB

MD5
f3a5e032599aab569106feaa66b60047

SHA1
19658fce154f733a03b63724b602e86e863ae2ea

SHA256
417e031f6c87ea2e2cdc50278f7518c07423ab53da49a0aea2db99323e11fc8c

SHA512
d7960e4443582a978d95b235e9cf9dc76607272b1d716ac71ada07f2f4a766ddee71fe6d874393dc63997c8eacb0ff79185a5ba6c2f35b017f75bde8d87e6370

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\01F14F~1

Filesize
11KB

MD5
b80a85ecef8c711309fc01f81847c145

SHA1
1fbc3ae1f03f2eb5aa2df7b457a3a6d0642ea8b3

SHA256
58ed3a04f33232a184286cfb76f1d42aac1f9f478fdf9fb27a37dac3cb820e6b

SHA512
86b7648ae9aaec1e623783827fa69362c797a58dfe6a81b2b216105dc0d7d6cfe3380d97ac216d6ffa16ae050b328610a966f835424ab8472dec43e8a54cdf41

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\02121E~1

Filesize
10KB

MD5
07fadae1591ed32d5638ac4c78318db9

SHA1
cdaffd5dca1b1ecdfbd418e4c2fc701636242ed7

SHA256
3478e630144d0ef05522dda38649aaa7cbdf8ac4fe70857de1c29797f7f07e01

SHA512
2ff5173c0e990c28596a76a1e9e8667e8949e234342a0971ddbd89196d462f91e5dd44d33a11b137a9384c3f19f7b5b7c561d3b8a02ae952ad324834c5d89dfe

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\021253~1

Filesize
10KB

MD5
426449c36242fc9c4d38c36ce1752448

SHA1
515c51215cc787bed4eceaa85536183882695133

SHA256
03723f5982a6592e55b47ff44ae57a5553ebe157e611d7027be7b17746bd322c

SHA512
71b662f76ca8511cab45c70094bd9ee1957e1cbca8eabc7f3fd2be5c1844a526950ca929452e372cffee46b60fb7120211f5769c037c31a4b0acf2e0f7b7b885

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\024422~1

Filesize
11KB

MD5
98edf06cabf6b59fecb59571656a8796

SHA1
ebbcafa2dbabb526d9dae86816b37f4a8e2933ec

SHA256
1fe91c92e6eabc667bd7cdfd384d159ba7ea4c4283c1fb1b488d67743013e0bb

SHA512
440b1b16086ef3cfa6e52a4112778f1ac328c715678639a1f54537242b6efc9c700e6e52c5cc66c9b9ca4dfc2dcdb3c64c43b8533a464d3a540fb49bd654a678

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\026A91~1

Filesize
10KB

MD5
1b1754fbcbf5404cb195b8d1ba61386b

SHA1
4d1fc08f37a5cc784cdaefc33717d19c496bb8c0

SHA256
497c16b28073fd65e317baed6e9199ae614c38380a806f32a9c5f33a0fba051e

SHA512
decf0ec0b4081df1cc6d0fe85953fc72fea47aa6a580efdcfc32ff295bccf1d2f3bc55242bcbe91c25575be7627809a8b572ea75239994a26f8f3f205b4d6a33

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\026E65~1

Filesize
11KB

MD5
1791ef7289c6afeee181475b93dac300

SHA1
d64cbd50645bd55e6ddcfba75071ce2aa4f10ffa

SHA256
3bf69b2522ccf5ff5525f00229ed5adaa2de8aea8bb1250a54eb461edb706b71

SHA512
2ed3007d0e81833b2c04017fa8955f2b2faed4cd63ac958771209d873a5449d6a5844db9d813d56d8ca16558d9a727e6d42b7113c24bc2ba4698090377913f8e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0275A9~1

Filesize
10KB

MD5
76862ef926fc9258cfd0cada733caa50

SHA1
2ba7b8d569fe498cf3a5fa355368848c0c2e68d8

SHA256
30f489cbae6678c01a156e9ed9d08c198b3e54685dc905f1ff0fc2a92b55589d

SHA512
f0e535b036164b3c9ed218450144aeb58c8d740dc8ae807ea9643ebb9950f2fad1581bf00f451682143f274acf21622af9ab8ca081d01ea9e0d4b209fdfd0bf4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\029A09~1

Filesize
10KB

MD5
0c6a0452a67e3078f752c1a56ce58cf3

SHA1
7efa0865ae2716acca17141dc52d39a33e9e8f54

SHA256
51f07386c6ec8d15700530a017753930e973c681f5e418bda55394731ae9f01a

SHA512
1bf421df232d27d00b822a40dd4aee127876d61c0ad4ed2e26f7907269d836a858d9e7d56f2b118f62af1a2dc8388edf706f0db1268d7aeec962fa1c6f3a7d30

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\02D03B~1

Filesize
10KB

MD5
0c09030baeb4d4c3f190f508895b3475

SHA1
6e386ce7c570f52a44165047897485912420351b

SHA256
5c0b6fac4510e0def70e6afd7795b576349982e7aaad29f7507e27bf824531aa

SHA512
8028728c9a42d5a853979dad598358dc5a6f80973a2d63ac1bc94e67121845962e02160f98f17a9968958d398cf68d16051415cf9bda1beda84148bdbd92263a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\02E134~1

Filesize
10KB

MD5
89a4e94b47301fd90d19f95a6281cf0f

SHA1
b2e39fb232c79a07c7939270e405c86732421146

SHA256
35df88bb394f487941ddc6cd4749bc2211753753d25689827ef4fc354beb0363

SHA512
9e8e8be7ad3da5a262f9e1e957775a4df4aae18390523d4feb70108b77e64ea23c6c252a9244f4322adf236ec03bd4f5213881f50f861663d669c5485ad9d3e3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\030357~1

Filesize
10KB

MD5
ac32e50c20a363e8eca1f095039eedf3

SHA1
b05723207851fe6bf71c5125792b9a41c49ba98e

SHA256
b500c63663a2b56bea672eac0e56a5533153c2387ec464cf6cc220c88be89724

SHA512
5e9087b5c3e7406138c91c666ce5f95b82b1124407717a1986162df9a387adeea51f5c656b91a87f63d7324a0479efce625c23e10f0d022cd95ea84167760253

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0304D7~1

Filesize
10KB

MD5
11838a3b499abe1585c146300ad286d8

SHA1
4d74d248628b0083e509eb4a38b47a98806a7518

SHA256
9e714049cc5fe6c3a22d124d88bb2d9c95ee1261ba006ef37c2c270a69777e9b

SHA512
d547c565907780136a425cb56a310ccd299d2fe91f7189928bc4800ed0e654d623754d550e5716e1f7360873d898c8987b6d1d84086f120ef8dbaced17b33d68

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0305BF~1

Filesize
13KB

MD5
35343660766ffd4a3de37560b65c6232

SHA1
7d27034bd381e8cc1cc0759eb698a26e0bb13bd3

SHA256
5d5d41bda0917383ff349f0693c3e2954c7f59827568337b620db7275a8aba7e

SHA512
46b3e9cdd8a4d7e510041ed05c53fb8957795345809f08d6618454c32b8afad84aef72986806e9745ec3d28b9c3cb992a659627527e280173ae56a6f1c0cc5c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\035DA2~1

Filesize
10KB

MD5
ac9b2aa734aefd974ed9b59a89f2b68c

SHA1
f2968bdcddd43a0f236e8308e85f7e130938148f

SHA256
073a43d32216301c7c0344e3db2ef273fb6a0b5035793635af24029a772274a4

SHA512
2f1aa6f7700fc23c31e906b1d85701c0aacd9a8b1c527b202330d0ba6ba60f27ad1e68c5fc48498e044842f640553330df7e410225305c1cfdf4f3c6f9926c1d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\035F5D~1

Filesize
11KB

MD5
de75848e6cf9c9bc7c3cec846aa4452c

SHA1
687da4de8395427c4c25466a23be620b8deb6fe8

SHA256
30fe219fdd8af9f766c0efc6fa6b744f7ad6e954dce909169a2e3ffc8bf04fcc

SHA512
b991d7919bd027c55c3ada25ed25c6df599c0e5d096cd990d6eec531326f73b5c57b88491e8d21dbed795e46d63883056d53bee03f765ae800ecc399bc689a1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\038A14~1

Filesize
9KB

MD5
092198c3509174312e5cb621455d6ec4

SHA1
c95c9dd6a578d77a722a14c2f3ed0d5b918f738a

SHA256
ac0c165bc7900850a3516b086f684391a62ea880ad5c44244fbab4610fc995d9

SHA512
2b3deb50547d1bb98a8ca58c420806b6df865295d60505dafb60252b6ef5b259f9dce4601ac9c3161d29935e3e3614d0404403ccba9f94415a4c318f4f84131b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\038AF7~1

Filesize
10KB

MD5
3fbe8b0506bcf2d85e3e3c942966d598

SHA1
e8fa17819ca978523afa40d6ef3edeb0b38a6c2a

SHA256
bc18c76052fa533088c2c1a1594ab63080598e8ac9e1065b9d4c862edd175e6e

SHA512
5ce0669cecbffae482df8adc6e79b63acdc4499e78d94fea6d54719fd3d067b7bd8fd72ad7b7037a342694bed9c32dd77970208f6a281b721879c7205cb6db45

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\039591~1

Filesize
10KB

MD5
36549d007360cf8d0fcb357e10e9c134

SHA1
318d5499c5b2d013a611389277e52bd8601dc224

SHA256
d90db959be1df43db0067079c146f9f25a7516d8224f8a727c92d5b901a22526

SHA512
69af5806856c045a6f3777b51cb9ef12371e6616b05d427d3e52341b50a49632b249d00038eb56eda0d0c6d488b44658a46be4de63d571d1295cec4f48ac4d18

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\03BFBD~1

Filesize
10KB

MD5
70ba3f7020a22e4c8b812da6b872c43f

SHA1
5ecdb64e9d2f5b3379d851bd3913ca984c67ebe4

SHA256
01ea3b41ee7684a607dcac2720b6d6d8ca47e870b607ba2748c49bb8afc94c14

SHA512
7bc75693974be035d8da54f4f029f806edb880e29db9632607d73224dd5c4d0abd4401da98e3c7cd2d6da2967f8d4663e596bcdfed2a5895e0d28fed36b87885

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\03D6A9~1

Filesize
10KB

MD5
6949a5fbfe083a2e349b7b8ac62e99dc

SHA1
26c85e46e509799e68c2342469cb2b69fd4cd36b

SHA256
96cba2e280f75d6fe0ee3f97c8bbcbc487a72cb16a7d325faf2a423d4c351677

SHA512
48f87b26727959368d169296c85a9ab68aa405346828d0bf78e4fcd43389958f00defbbcc64659ad1cea0e9cf49b8379031851887926453e6967113f81ff8e75

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\03DBF0~1

Filesize
11KB

MD5
02a1aa9926dd434ac06846cbf5f30965

SHA1
56dc58133f097adad0f2b1d72dd73a7f5138f938

SHA256
09233f17215522b603e29691efc2800315fd637df48b81c5c123bbf915a1fba9

SHA512
f464d2d71218133afdde5ae31c3b47ec371dcd76bac74fb07f391de9efda1de818d1e5831154464222a30445619fa66ceb11ce554edf2f10528893fba8114908

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\03E2CC~1

Filesize
10KB

MD5
b6d289bbf1de51a75e02df4a51cafa3c

SHA1
55a6700b347911f3c89be8ce519d393cdce79e2f

SHA256
83a8b2a0212ddbd4b13abb2433ae587d02362b5497070e41a9880efdab581215

SHA512
a0fc0df229958b21e926cbd4cfea97201843a29ba47c31cbda5b6fdb6a81551414a33018b391b60645c9421d0697e824a855fc54aa5c29f764439ab983292a74

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\03E436~1

Filesize
10KB

MD5
68a3a7f1a1bfaa8d6c12b5070566ad12

SHA1
1fe940a6564c9acb6829fac1b8634fbd716d440e

SHA256
ed4e0bc4ece32c524e8d548a9c4854072a044788223dd2277a8a71fccd613a6d

SHA512
47dbc1f788950b61ef19440bd8f4961adb35f7ac171ae1e15bb94887692ea5af6811ae0bdc2c392027fd990aa2113f2b03bdc299fd2e6505a1fa8ee7dd525564

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\03FBE8~1

Filesize
10KB

MD5
05ea7f5031901ca4e0ee96976dfbd412

SHA1
df4959dc2ba2508c3beafc59125f1a64f8c57fb3

SHA256
2f3b07d86bfe522ea147d6e5fbd00b99ea518bdeb5faa8c79040769ac003aa1c

SHA512
09473beb10aab98fb6b8119483af518ea149767ca87a10b444e9c549df4dededc47078f760e2a7d1b90bd5ee5aacf7492c603b575d0659fe1e5df2e974f3483f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\03FEDC~1

Filesize
10KB

MD5
155608765b43644f5a7f6d029085bf04

SHA1
aacb4ad5e5398afdf4f52482bc8e9ebd2e2bbbd1

SHA256
3e4e85b100ed54110d8f71f7d3eabc8c24a50c20cce82cd90c39d8ebfac5433b

SHA512
037bbf6a483526c71d971b6d1337df665c008fed48d4fd9bfcbc8e522abf021d37c9af6131477f2047abaac08d2dfcdfa63b3da2389a52e52d93865016bcc676

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\04021A~1

Filesize
11KB

MD5
23056fb16f52cb0aa9ea942dc4ccd635

SHA1
1cd2465517595a816c32b9028f17797339b5a160

SHA256
afc653d3ff898555c3aba377397ebe8f11ea221dfa759ccb73dab66d84edfd1d

SHA512
2dd599c8467afdfff6804bb0fc844259ab835c8520398c79ac2ebc5e76c33ef7ddeca32d6700c7d80f58a74b99e7ce8bed18368d627f27f9b2ae23eb23d3db45

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0422D8~1

Filesize
11KB

MD5
12cf4b1a7ed1987cb5aef69446c211c1

SHA1
76da3c821e230b62672ee599c9539677c4cca5b3

SHA256
606e0cc0c6ed4492be3d1346e6c9f1b455d4f398bd4ead1af64ac64832f72a1a

SHA512
3fbe94d5a9a997bd4cddb58dcf0efb89dca42a9c949333c1753011bc08dd2f7a9e42f20eeac04b68ee36c32a5b0691309b16f1955ff1815539d106d92d036b8d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\044517~1

Filesize
10KB

MD5
46d83ffbcd0da7d3d042b55441c4ad93

SHA1
4cfb8807c195859eba5f98a43a060ef9a1a320b0

SHA256
e46ebaf6a803a9dbf465517fd491ab2dcf82354ac6c21189b2ecbc77c324c2c1

SHA512
5d21d0f72f44104a36573775f557187e9641f41fc52e0f088d50cf0e3a5320f7728fafcab3593319ed307d839dae58aaf3dee6ffa072e76551db01bc8515ea91

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\04C189~1

Filesize
10KB

MD5
b632a30667cc3ba70b9fe45a0d527d48

SHA1
842b6be51e6cefd5f2f658727d66d0454b227a9c

SHA256
d01366ba26e0443ebea7ea88dd6de6a74196de6054e70940ea6e9b60817c90d9

SHA512
c3512ec3b4e01ed90d78b10bebafbb2cf84f0dc70aeb9208160cce436d8334dc1369e496da1d726e1b4bb8ccf2cbd5ab2865ac35a36f9fbf93aa35609f416ea0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\04EFF2~1

Filesize
11KB

MD5
42a189f50231cce24b8409ddd41ea613

SHA1
b93503e9413f2bcbe940fc13226e16dd998aa19a

SHA256
69aaacb3dc02e2bcb7f85d1d9142ce44512a0de6d54f8cdb63ff8f556b4a15ec

SHA512
35ddaa599103a5523578dedebf5dfd9ed3c87fd477ddc638b084e26136ab0ed6203a701862d12f8b4d0f9aab07cd799472304b2b876d2794e4cefa2d40014ff6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0531A9~1

Filesize
10KB

MD5
e5e81d303eec07a20afae9afd8396f9b

SHA1
9d38a1de454a057137e9f68ed10cf74076a95421

SHA256
fb1d06c9566b481643679963dcff0b84cf9450da9be36067cb07d3b9e4e22a9a

SHA512
726895ab0f8acc5694172ab3dd87303997af1c5339062d2fd33e5716f78ab7241df1071f75e206f52674e16af68f07ae9f2d385bffd488a054b531eb7d3b75f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\054205~1

Filesize
11KB

MD5
8f79015091f2cef1aff4ce358ddfaa58

SHA1
ac8f703733ef464332840eb7b80a8e138ad38d98

SHA256
6eeacb591f01e2211476e0364c62dc8f52dac0c2fb4c46c636315209e7aef30c

SHA512
cf48f04278027f75bbda10ae6d3d8e8f6b123c11ca3f07cedb73c5963a79f31ea320b230b2202fbe2c063e561619478284e2829792ba5433ddcb9f51539a67c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0546DB~1

Filesize
11KB

MD5
9db0b694665351efa43c1b6f76aff611

SHA1
30a99722e9c6861cde0d5e026c63b7a01974828b

SHA256
e59f17f5255bd458a872367e9d230241f9a45add56de92ba4ab34285dcc595c5

SHA512
ec4987da6660827ec0f5c9a0a6bbc33210857dac4370b9e5ad74a3275d24a2f127208d8a05bd79a3555d77a022aea71130525b383bca288d3a261ad70254ca35

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\056B9C~1

Filesize
11KB

MD5
02c5fd930491daf5afde4fc26f1bc257

SHA1
d00d7ce59a9be81c72d8997df905f92f01635782

SHA256
a12f7aed6fcf8b663904e1aa0fd6b088cee0ffba31f819120ec4d58c59256a6b

SHA512
c6f64608c9d542023322876f8bd0a4b4badf27cf78c74862006583acb231c9b9b12c5d22f487e83cb0f6a2bbf7870a784189117a4197a839684758b09e4d4b26

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\060682~1

Filesize
10KB

MD5
9d3072700b4473a90597bb86f2d3baf2

SHA1
3d8a600a1e64e51a7106ff126a66f6273c64659a

SHA256
c636fa4dbaed50eb0e4f4843abd46f27d15aed4a56a19a57390afe979738a6e2

SHA512
95f70fce7b52636edb4380415de5f1eba4164d372a1e75f95001dde174fabc0210581f6375665682f5cda3186381fcfe84fa962e73276e95b8a8491d2a763632

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0629FC~1

Filesize
10KB

MD5
f8097a397ad9e2c898e44f02d6130109

SHA1
bed531b19cd92a363774537f1422e075f1773b8b

SHA256
61f4c85b800c63dd5081ec5c2ee94abcc5fac49542e6f0395a317a4cf056ce28

SHA512
00f60bc289951e5978c6790b0af0848522f60c76199f66f3a34e7680f155795b91ae0a080a4b1841bf356a0aeac5d744aa76569794e0f76ed0837c3172b34960

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\064387~1

Filesize
9KB

MD5
deeb9f42710e42c1f8cc8850c00f8431

SHA1
342ae63ec118ff4b4117faa9ccc3c9074adaf157

SHA256
ea5810342c322f6429d0abebd1f47c05c44c7ed3af6fc05a2e12c666958ee953

SHA512
84b5f11b2c3b3f2f23132d9bb4e30f8df724e6acb331639b4a1df00949e31064050db29906659f7cb3a2a7722da9793afa1311a87d0d66c438fc36f27d8d7bff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0656C9~1

Filesize
9KB

MD5
409a720bc0408f7bb92b89c36abb9f4b

SHA1
b4e8327b9f83a4477ed5dea424b9c672af729465

SHA256
dd3aaf5ac03c8bedb4fd624d89211a034cf132b4b1343bd7ab9154d89d59c343

SHA512
e31d6e9773776bb07ba2bbfb95192f3bdfab5af471fc455c5955787711da64596f0c0ffa775995677355b91b388c3a1fb441b5a571e8687fd72979f1e205ed4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\06683D~1

Filesize
11KB

MD5
436df1c3921015427843e03a0078e0b1

SHA1
84a51ae2960f5eb8e73b9285058a3f70fa880a03

SHA256
39b7f2bdd3a23abeb34eec644dcc7cfb8b0a0516d9a5b95832baf91d96c6fcd0

SHA512
6061417b0975772c4d51e8f771beeb97e025dd03f976b16e87e32f039da4e3e8290c71286a5ef0cb47f21ca9da21295df6706163d9ac5a52c47cf7ac2fe45701

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\0693EA~1

Filesize
10KB

MD5
54dea5a3f25e4ae63a5bc9527517b54d

SHA1
3e6afa898b4393fdd27c24bbebe7126168a9b7e8

SHA256
838318bf33517b622c08b1b33b76531335c412a06972c1c444058bdc8610017f

SHA512
61d0b1ed2648f7960acad7a9689bc623ff4d946e9b7ac7384ac1b7a6a4fb726c49decf33f88b11867dcb880a0b676a745885daf4839c3f1e236e0f64083863a4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\06A234~1

Filesize
11KB

MD5
405fe9e24632a469046c39dc3b753f69

SHA1
4f061e8a66bb7e3023108b4fa6e273ce51600d99

SHA256
dbd6b6671656393d3aa897bc8f524f7555edabd815c7e781384918b683f54b5e

SHA512
6e4a3e046b6bd1a63ff53d0a279ad2f330768ce9b042ad100715f15789af5ab73d125e45ece4fea33b821ee2a0f3591284d1d0a1fc7eaed5b33d34a3bed0c312

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\06C937~1

Filesize
10KB

MD5
66fa74d39fd973f6c77b4cdb08b6185e

SHA1
af01ac88f865a900076130618599116965dae4de

SHA256
aff5a90e5f5b4b64f1f3ea146bbc6b66c86ed35c621f5941f82de2638ecf7d5a

SHA512
9fb12a45fde097eed09b48db05a9224514aa6616ab91262d12436a9e6244d23996bee3ef65ac5e779184a2ded0fa9955d1e363c3e4d137da34ec1ce9cbe5abf1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\06EB96~1

Filesize
10KB

MD5
269f33c712b5de8004c5bc3685e2d74a

SHA1
a0dcc18baa116fe6b8d45a509ca5ef42630a5fe6

SHA256
369953c824a9f03eaa848ee53e69903afbce26c4036d8390bae76aea2375549b

SHA512
e16dc8f114fa8b606eec5689f0b6878309f17d29323d39e18336b3d56ff95ed7d0eeeb1a96452dc1c77d5ce4b879e2594fb867bfc394dae8ae4000c6477c434b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\07339B~1

Filesize
10KB

MD5
835b1194bc9f8b4e8ff2c958a3808ad2

SHA1
a450e1122eebc8d68d1daec7f1dc33cfedee7263

SHA256
44b6aaa043180999e078f6ced8d783949f2c46871e3f887daa113d9dfb47b659

SHA512
4251f947f78715fc1495921db46e71019ad1e8e8ac51368d7fad513a2a583b0b8774719eb4bc0beaa7af080b2599d93bdbc1bedca48b91c81b687f82ffe6863e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\07511F~1

Filesize
11KB

MD5
925b7bbd6a7ae13e069d8cab3eb0b79b

SHA1
e3517e0024e8c16cab5a0a5380cfb1f68f2342fb

SHA256
2f2dd6177c9e91e57e0a207d4e32129ee079a914da459094bca35e674ab5458a

SHA512
28f005504404fcb73f139093ed61a8ed15e84e893fb8d6503e0b54fc16ccda53eda6592da6e256c1f8ef06e96b9922ffd310232f90f716663c43e23118a1967c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\075472~1

Filesize
10KB

MD5
3ec97e3ffbfd8abbf08e27a0f9412ddc

SHA1
d408ba72316bd3432b5173cebbf96ba5d5fd9230

SHA256
ab5b14c43514bc6543ffaaceb2bfb6192db83f9018e71199504fb20bed402aa5

SHA512
5aab0c5d1d086ad8c1081acb15d976d49f80cb724001b63d73545119d33f5e8d1993fc15617b79435895a634c180b388f617afa51666a8c1fc66a7490c3cd0d2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\077083~1

Filesize
11KB

MD5
3193a6a86460f842c1824a05c9239508

SHA1
71c9c5f0dd92d32e7518c4fd3df92e86b589aa03

SHA256
a2c50db73ac2d5ca2570c250a60df07a03cac8485146b456ec0c669bcfc099a0

SHA512
ca9cd478f7476a9e8cb20f729650cdfae1ef331ace61efc17018b1e0956d4a5b21795764cae945080a6d1a463e903c94681aa3c7953e8297287afde38666879c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\07786D~1

Filesize
10KB

MD5
ed4aed97d4d3a350d9ec978f49b348f4

SHA1
165747c3c29a2c303d2b4fa6702273ae804ef8db

SHA256
e6502ef120251615ee28abf2b6c6b8e8e96277c3a25e24068e34df49eb452a16

SHA512
927d0a56bdc20c343bd6fdbb5ce7eeb28e8916b472994cbb84cf5c54545392a7362b4e494f598eb798c4b9e7e8bee4927ab9456d6d34a9af837c66de6d4e3b74

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\07A378~1

Filesize
10KB

MD5
2dc68cbb36527e45d1923d94a9a12609

SHA1
bd93cc530bf7104f2d960291600b83b9febb390f

SHA256
e9619788ccd5c4ba50ee20d2c0b792041c09bbc8c9e0558ee2efc8561f572ed0

SHA512
3a0e6671e91e69b992ac8f9f4840c8f4f864772d019fe7b11a3531e385e0587bdae2c8c3a320c689992fa5befff11e4a4b312afdd9f19386a1ec34a81eff8891

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\AFYB4Q~1.DEF\cache2\entries\07B860~1

Filesize
11KB

MD5
5da909a603ab468c390586723137c1f2

SHA1
8b36c7746045bd81567a699878cbb60aec4959d2

SHA256
c9ceef79c0097f2ae4386457d7284f9982e8ff976536569927723cecc988dad0

SHA512
e4b5368f5ed61e1757df4d2cc164e32527de1100bd233da08b0890c44206df6e536a7e543aad04a2561a6e5926fc0c01cec916c8126efe3fd710f0e8dc0e2b5b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\afyb4qvh.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99

Filesize
13KB

MD5
af8f5c95d4786122a493ceb865152430

SHA1
0b19ed94a0fd7d83cba3e4d16791a4384c61cd19

SHA256
22b8f8f334ec76f1efc93838a28c39b906a9dd6d984fb59d0eb299572fdad86e

SHA512
3f387d4fa2049d67df1db50d36aa2fe4ec7590dfdbf023afedcc3c9ea51f97722ec40746b67284b117370cea4a9159e8f401c4ca21c4aa1c645879f6a910b478

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\9GRGT1WD\microsoft.windows[1].xml

Filesize
97B

MD5
08b8d79ce206892db7c0c3c98817bcbe

SHA1
fe8dc1de6f56471da7af1a1a346a898af1c0654f

SHA256
b5dad30f24e231a8399fc87617c0a0150681eb2e9036fd64e0d25fb701ff0682

SHA512
cd367049142e16c3a1759140470fb6048d3d2bb7b352f93f2cc994158aab4d1d16c4d6ad1dc2ff8dced69eb8bee91229f79e6f99820b33ed8b9563f0bffcd468

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome

Filesize
16KB

MD5
987fa60665ab15ba306df1f9ef30d5bc

SHA1
2daee868cc9914eb7cbf1ceed0107e5d2267dcb9

SHA256
277660b4840649422ddd0633e561c446bee224b956850532ff0573eae34fb61a

SHA512
2913ee54036ceb12affe5a5fc8de35143b4e19c1f4c44e62e974752c3217f10aefb4a9d41ff54ea5aa9e6957a2d49c8dc84103706e19b459428de200ae8d5b75

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5952066d-0717-4df6-9e30-8bf43c8c883b}\Apps.ft

Filesize
41KB

MD5
d2d9e402f296b901d488b4872affd70b

SHA1
35462f5612344dc8e56666a22f98afa45674ce11

SHA256
f515a0161ad0817d2a6745b2f4852f5a8e9f2c75825dbb535f0dcdfcfcd6da19

SHA512
72f4b7a548f2462fc82ac60c58c7f3eacb394c5b35af1c27f0bf2535942bf151683088af9d0876e95a419ebb213f131f2427adc55896a0463fd7f826e30d509a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5952066d-0717-4df6-9e30-8bf43c8c883b}\Apps.index

Filesize
1.0MB

MD5
c20bd2545b7eba40a1755fa980853f63

SHA1
96966e973bbdf53ad4e0213f85aaf4c396b183af

SHA256
d926a60e9cbb28e16da0dd2a12617bc17a9a20e959ff4d380b49f29071b5a59f

SHA512
e7745e6d91f4e2ad50a0664e1bc08249941acea8b8d8938977d82f0c856fc14143895ae16520034c8e4ea22fe62d79671990b2514e0dbe14d4b6aa1a54b83cd4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{96722b2f-ce27-49eb-a60a-b27342713643}\0.0.filtertrie.intermediate.txt

Filesize
30KB

MD5
36a42bf6ad97ddc05d44950c776489f0

SHA1
b65843be29c6b4e785ad359976e365ef39531189

SHA256
2aefb1cdd1fb95d01dbf726ed807ff542a948737b0198164dd48c4f8e8789e19

SHA512
d1fee0b0ccd0d4a74f45f03a1aab7fa3f7cd8859866efffba252a792a059e3f52185ed531c5a2c62e0ce7d380ae382c9e314de125adb335d0f8fec6a93b2bf54

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{22413518-7292-445d-ae4f-23cac5854d3d}\apps.csg

Filesize
444B

MD5
5475132f1c603298967f332dc9ffb864

SHA1
4749174f29f34c7d75979c25f31d79774a49ea46

SHA256
0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

SHA512
54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{22413518-7292-445d-ae4f-23cac5854d3d}\apps.schema

Filesize
150B

MD5
1659677c45c49a78f33551da43494005

SHA1
ae588ef3c9ea7839be032ab4323e04bc260d9387

SHA256
5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

SHA512
740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{22413518-7292-445d-ae4f-23cac5854d3d}\appsconversions.txt

Filesize
1.4MB

MD5
2bef0e21ceb249ffb5f123c1e5bd0292

SHA1
86877a464a0739114e45242b9d427e368ebcc02c

SHA256
8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

SHA512
f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{22413518-7292-445d-ae4f-23cac5854d3d}\appsglobals.txt

Filesize
343KB

MD5
931b27b3ec2c5e9f29439fba87ec0dc9

SHA1
dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

SHA256
541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

SHA512
4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{22413518-7292-445d-ae4f-23cac5854d3d}\appssynonyms.txt

Filesize
237KB

MD5
06a69ad411292eca66697dc17898e653

SHA1
fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

SHA256
2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

SHA512
ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{bd9a2d70-8fba-4b34-bcc4-889a40a9fa41}\0.1.filtertrie.intermediate.txt

Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{bd9a2d70-8fba-4b34-bcc4-889a40a9fa41}\0.2.filtertrie.intermediate.txt

Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133750485148752702.txt

Filesize
80KB

MD5
f577f61e4bcd32f7d9adb3c141ad27dd

SHA1
fc59c1728b9987b9d4e39bdfeac77d71052a33ec

SHA256
153449835b91e6cd13d8770850f736740774709b9d6186306e54dfcbd96cb7b5

SHA512
2d279e866996d846cdaba12e50eb076c9b480e7e5a52ed527a593daac31335444910dceaad4907d6ca80b59bf8095ff1a0ef51d72498042a3eeaf72524ccb414

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Filesize
689KB

MD5
2dee0ab82c5db228dee2de2fe0d82eb3

SHA1
c6231ad00bd775537fb422a86bfe2b5754e9b91d

SHA256
0e01a47917642eac553b6d0feb6e97b398f7af84c5ffc74ba35ca66d7a341d39

SHA512
c46ae09aab1f240ba384044ef46240a4cb02b6144b0403d690ff7ddcf79acc67da345c98254ef5436a4008fb419c889af43489fedf86e8ba822128365f30763f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
10KB

MD5
e69a8b0f87052ba32f55549014a3138f

SHA1
ef7ff012eb120b11c112514965be8967182dacb7

SHA256
649a92e5ae17bd2c9dcca4bcab27fc25758611fc5e1df3539bdb91a2046dccfc

SHA512
331b6e31ffa714244b6640bf8555d9f78b0f277ba2c5e1b7412750f9cda4eb6b5e941fc78503910380bda4ee02976bef5de78d9c77fc528656d9cfff7894318d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
11KB

MD5
04d7cc9018988fa6796f6ee97abfec9c

SHA1
864583d5a0567ca06aedd3ecda89d9dbb3a925b7

SHA256
7ff0d4997970e74659e1e1f0832d814fe27bfd8ace642c59a28427080fdeec22

SHA512
64cd402dc21dc31207df147fefe69c1ecd0bbde0ed85af4c105d7bac51214ee43a6a89e66793110837200953c8b9ad5bd9bc198c83105a982e5c357b6caca7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-2

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
8f0ceb66ed3afec51a9a3ca4931ed5b6

SHA1
92e5f7f290d3076bc808019bfd45dde0e484beeb

SHA256
f332a513e1a33ec15d650658219684779960f6afbc8df3c5bcdf4f2d1a620ead

SHA512
be561f5bf9b66a6ea14278d94f5c7f748f2bc1f03e875fd4e016ba55d65999cc00f9d31ed327ad34915cbafdb171a9b1c9f04376a05c63ddfc10b7a8a6ae3063

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
06bb3b85a89872db9944716edb37ab81

SHA1
0a1166e32e305a35abb93757c40463fe7204e534

SHA256
31d44cf56b60cc85b924fa2f8d59e760d01d2521d7727b635d19b094d1793631

SHA512
3e835cbcff35a67a0feb0779b839d35cf155d21e8f8e4a8a593ff8f7eeef87b6c7fddc22822217b892ff02419ca1abf32ccba0e4c92101ea3455ca7c56a8f70a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\AlternateServices.bin

Filesize
8KB

MD5
371e03749981d01a51ce7b1660944892

SHA1
1626e914a5f00e04ab107a0ade0fc16f6140a0f9

SHA256
5b099224c4257cec2cd863ca01badf931af31c2567344c9d96b474961f3c0bcd

SHA512
df14267336365a2ea8a7940e1624f7b8149ccbe2b123b72c35c1773bd78daabaa4902d5967adae6d91146232b31c4d36abc26afafbc3eb5beb7ec49a66be2c02

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\AlternateServices.bin

Filesize
13KB

MD5
6fbf4aa1cbc6b209e84952f6a4256a67

SHA1
8e6b61c9d8c5f6e27fb23e5c3a23077b9274245b

SHA256
090a704646c35433f4d3d0e41fbd39123ddb48d6119b851f9727b4fdb65006b3

SHA512
7edba6f5978d5a3815ca653faf75955b8eafbdc202364c3a28510156937e8fcbb0089cdf70c7c802a946fa6777d4c1fda88cf839d5c87ee9e40f92b54e16030b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
1bcd61bda3e4adf7c1510a3230295ba1

SHA1
12f8702b316c8adf7e48e460ec4327924d718b27

SHA256
6f1a283741970730c23f61389e8a0efcb4353d7ffa410044e0b75ada80cf3928

SHA512
03d01c750b30af1e220985f6321624ce701df87d93dfaa8ef61603651677b035b851c36fd3ddcbf380698636d47a8742307638cc020e49865ac667b561072e6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
4e02671375c28ddaa9b606679a707531

SHA1
4405954ff802a225fcc87c394511093dffd3649b

SHA256
75322227758b03b4b39ef5e7b36dc6e962e85c81330f3e9deabee7a8bd083b25

SHA512
32324be5d133010ce5fd6ce6ccc351ab328681992a07359e7c3738cf4af15172db84ec16840484e29713eba5e715b4923184309bb9f0320ff2641ac4d71e587f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
66faf1edc0305ec1704ebbbbc099ca89

SHA1
ee2e8fa4de855df4f1af5231620894a1483cba98

SHA256
d93a8e52b14ae667b3c9819780a681d0d9aaa04ad9f443a3a2224d0ea026bb72

SHA512
b89ca27502684278bac868789c0957c118beb423145867b5b0639c5a38e0ca7204969629a07c775b73e79cbcd3dccb945157ed9a9415580aff9a05d78fcd98ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
262f33539cdb060ee3262e59c25d5337

SHA1
3596db85f7a9a959af7e14d62d803b60603c2fd3

SHA256
6d074e5fb4cf956aa82d0859c2424d392508ed5673e944b3805ce9b2b69fd4c4

SHA512
4b6e1557e4cb6f8da670718a798bc85d8f94891e56120eda2352eea59a905d79755b56b261dbb9134f984b04209bfa74925d981331b40aa0cc0c412489915116

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
0c93689f49414e81507aa673f915031b

SHA1
7accd68c0861e23890d142c86d728b57e97036d6

SHA256
1c1082e15c67759f4cc5174a87adf1e2799b9d3dfd77602500725dbdab29b49d

SHA512
2927fcb366974c771ba75065def7517a4e96aa58b92fd7da89409a254f7787f64ce9678b81c27ba3f8866d045aa9e0ad39b9d4a844a1696e116aa034d435915f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ff02905970ac13545112ad25dd8e333b

SHA1
d9dce8a52487fae5a365dcfc4b2ac86d7eb87d7e

SHA256
ef642131e121d5cf4b9aafe5e5af5dbbc50e637df2e568d2f49967ce9dd246b7

SHA512
6d1a993d805549dd9e59f53b5f2cdd68fec7eb2a4e7734c7bfc85cb984cae1283a7b6e67c5a4937b65cd1414d74c18aef8743e1f21f1200c2b7c047fdfcaad88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\1354b075-9728-4f5c-af21-226a7d58fe14

Filesize
26KB

MD5
07fa149f93b31b3ab4f5ad3a46ccefd1

SHA1
d1ad1e765fd113209614099876fb7920e0ca870d

SHA256
8ecd505c101dd3f3014588d928faaf0300d51c8f9d7d90719e5f06b1c0be1c8d

SHA512
11d22c3c219dbb9c463f9c3c51e95e6b06e0034c054b06744c822f10a4010b941e68945b40f60f85f8f19d95779689f48ffe0ff16f21b913ab2cc9d2a5426afb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\6653fc6c-4d5b-498b-99df-ebb74646cd6e

Filesize
982B

MD5
32096f4c1eed9b4794062d9879f58a92

SHA1
4072a35110cdc0ad605168fba75fd9b34848e9a6

SHA256
0576d61ed40cbfc19bb1250b57c078a426fed8449c21973cb88cc074b8392b6f

SHA512
77e4b255dd5a306d73190a1554aef6ad22364600663ce72d7af18088c0896c7db5bd7b190981c4b55f62aea44acd24e29ad7c5d22180c9e8fe6ca41c717f0fef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\datareporting\glean\pending_pings\dd6d5e20-c17e-4e3a-a7d6-e6bda59a802b

Filesize
671B

MD5
8f83be1b2bfd72729009de649f4e814b

SHA1
951ba184dafeb2ba56dc1783b5d3d925dfe3956a

SHA256
3864b9daced5fa0a93e4b04864c67f95aa582e4b4bc019d3795f301ea9f2ea09

SHA512
a2ef8fcf2406c01410eb31f049868da3ad25da7732cce842d9dec5e97aa644eb28db34947d8e6dc3fd8ac0a86f0304a79724ae09261017696dd8aa9987b6c3d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\LICENSE.txt.tmp

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.lib.tmp

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll.sig.tmp

Filesize
1KB

MD5
36e5ee071a6f2f03c5d3889de80b0f0d

SHA1
cf6e8ddb87660ef1ef84ae36f97548a2351ac604

SHA256
6be809d16e0944386e45cf605eae0cd2cf46f111d1a6fe999fec813d2c378683

SHA512
99b61896659e558a79f0e9be95286ebf01d31d13b71df6db4923406e88b3ba72584ef2b62e073b2f5e06901af2c7d1b92d3d12187fe5b4b29c9dd2678444f34e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs-1.js

Filesize
11KB

MD5
8da5552c5e5bdaea358fb091176c0ab4

SHA1
d9990a7d3f5dbfc4d714cec487834e45b02f86d8

SHA256
f98ec0ca021b6ed8cbc757aa363164e1e4d65920bd76d4391ac75689ad018afa

SHA512
a526c0e13b24bdfa702b632a45afe533166f0eb2f13c7f251fcc0bd5b5815cee2a0d8a58094fc74404caad208a47583b826de08861e10c34db5d98589e4af255

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\prefs-1.js

Filesize
12KB

MD5
7eddd135609a480ed60485c402054e60

SHA1
794c809b730ee35f2ed07c36b3fabac8d5012722

SHA256
fdf398190311c365c16a828d5aca9433dcb7b6b930de2d27a1780903bae2b57f

SHA512
9f6243b05f984cd31317534819cf8e56423f906db5eb6e644f139c5aa5c86d169f347aca1f0a4c18c0ff25c1479e4b38cf8cf2d9e38dd30d6f9b3df244553224

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
6c9020c505c05db5749bb852f67ac84d

SHA1
b1b1a2cf42a75fdcab487f630bd2cc171946d869

SHA256
ad82542ae5bb013380e632a5e6964547e892abf627694e02133c5f4956b2413a

SHA512
bfdce63a8c0da50907b440f1a2beb975280251f77591b3bdc95ba0f4b8aa4664b27dea68ae2a3ed2b8d2938179c0dbfa1178b533599ed31d8028afbe5270bf24

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
848KB

MD5
17b4311eb19eee349876800e3d60a7dc

SHA1
93f99bcba84718fc1a12fe849ae04ad1a8bc093a

SHA256
3f131fff12e9882306b346142dcab2258405415667687a3ba4a64427059cb589

SHA512
5477cfb5a09b884e32e5787b13e32756b1a56439d5ff8efbe6ee9432382dcd4f83bb3860e73d3f0b06b4a57ae498ea64891d5cb4c67fd8cf0b698058a3d9d0c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
848KB

MD5
27679fa67c0db4bdf5129f85bfc6378d

SHA1
548a7753fa788935c14958e1eaaa873c61876bf6

SHA256
b433b8d46ad5e83614a30c395188b9acbf715b9a364cc7a50509c4bcd5198a9d

SHA512
9c672c71c22c116b83b2ffd75dbab1a3f26433fc594463bc37db18fe1194f74752c88ea0813a45f8b8e768fa8c312baed498e3151d437086d5436a37e73d8658

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\afyb4qvh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal

Filesize
56KB

MD5
71978d005ac3d79be95c48a200c3fd24

SHA1
9fe4ad5e921d7f93cb7c75884cf9a9b34c131178

SHA256
0acb05e72abe4223f027fd5a52ef637e81e01f9d758120bf13f49382248d84af

SHA512
e8749df81803caf10462ac23aa428e8cd42c1415975f4b6f46bbd6b742ef54e7455888acf1f79739374afa9bc7f23fe11941760c566500ad8765cf1cbabb1e8a

Download Submit
memory/2984-2862-0x000001C28B9D0000-0x000001C28B9D1000-memory.dmp

Filesize
4KB

Download
memory/2984-2868-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2874-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2876-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2875-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2878-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2877-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2879-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2881-0x000001C28BC00000-0x000001C28BC01000-memory.dmp

Filesize
4KB

Download
memory/2984-2880-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2883-0x000001C28BD10000-0x000001C28BD11000-memory.dmp

Filesize
4KB

Download
memory/2984-2882-0x000001C28BC00000-0x000001C28BC01000-memory.dmp

Filesize
4KB

Download
memory/2984-2885-0x000001C28D250000-0x000001C28D251000-memory.dmp

Filesize
4KB

Download
memory/2984-2884-0x000001C28D250000-0x000001C28D251000-memory.dmp

Filesize
4KB

Download
memory/2984-2836-0x000001C283650000-0x000001C283660000-memory.dmp

Filesize
64KB

Download
memory/2984-2820-0x000001C283550000-0x000001C283560000-memory.dmp

Filesize
64KB

Download
memory/2984-2855-0x000001C28B880000-0x000001C28B881000-memory.dmp

Filesize
4KB

Download
memory/2984-2873-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2869-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2871-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2872-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2870-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2867-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2866-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2863-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2864-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2865-0x000001C28B9F0000-0x000001C28B9F1000-memory.dmp

Filesize
4KB

Download
memory/2984-2859-0x000001C28B9C0000-0x000001C28B9C1000-memory.dmp

Filesize
4KB

Download
memory/2984-2861-0x000001C28B9D0000-0x000001C28B9D1000-memory.dmp

Filesize
4KB

Download
memory/2984-2860-0x000001C28B9D0000-0x000001C28B9D1000-memory.dmp

Filesize
4KB

Download
memory/2984-2857-0x000001C28B9C0000-0x000001C28B9C1000-memory.dmp

Filesize
4KB

Download
memory/5216-2918-0x0000018718E20000-0x0000018718E40000-memory.dmp

Filesize
128KB

Download
memory/5216-2919-0x0000018718E00000-0x0000018718E20000-memory.dmp

Filesize
128KB

Download
memory/5216-2907-0x00000187183E0000-0x0000018718400000-memory.dmp

Filesize
128KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads