quasar | 8f379aea1158c492af7bd6361b1b0c8e5b4d2c73062968eb3231da123c4160df

Analysis

max time kernel
180s
max time network
245s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04/11/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Facebook breaker.zip
Size

1.2MB
MD5

60baabf5f07b439be78195450dacff3a
SHA1

4c21ad0c866035b9cd720c904c07d6d5a9f47a8c
SHA256

8f379aea1158c492af7bd6361b1b0c8e5b4d2c73062968eb3231da123c4160df
SHA512

bf4d9b38a0575b7fe0200e3145cabd934abf3abd7192f32080c248b847787de724bae8f02ca6df207f75d4557270f8487e87bcc6100016ac27c5bfa61e498fe1
SSDEEP

24576:sPhAekqOX+cSocIXNgg3DZ0dgBBFegQHfmrcFebKpDH8pZJfXm5gQEd:0h+qOOc+IXPDZnFeQrcUKpDcXm5kd

Score

10^/10

quasar víctima bankofmontreal credential_access discovery phishing spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Víctima

crismulticuenta-30512.portmap.host:30512

Mutex

d7480f6f-e85f-4b68-8813-8279e2e6cb96

Attributes

encryption_key
8497DDBEB7064872EF356A0D1A58DE488578E1E0
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Updater
subdirectory
SubDir

Signatures

Detected bankofmontreal phishing page
phishing bankofmontreal
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00280000000450dc-2.dat	family_quasar
behavioral1/memory/2172-5-0x0000000000770000-0x0000000000A96000-memory.dmp	family_quasar

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 2 IoCs

pid	Process
2172	Facebook breaker.exe
3456	Client.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\	Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "German Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\lsr1036.lxa"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "È stata selezionata la voce predefinita %1."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "11.0.2016.0129"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - German (Germany)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\sidubm.table"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{37A9D401-0BF5-4366-9530-C75C6DC23EC9}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\CortanaVoices\\Tokens\\MSTTS_V110_enUS_EvaM"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\c1033.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\tn3082.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Cosimo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ayumi"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{C6FABB24-E332-46FB-BC91-FF331B2D51F0}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 aa 000a ae 000b ah 000c ao 000d aw 000e ax 000f ay 0010 b 0011 ch 0012 d 0013 dh 0014 eh 0015 er 0016 ey 0017 f 0018 g 0019 h 001a ih 001b iy 001c jh 001d k 001e l 001f m 0020 n 0021 ng 0022 ow 0023 oy 0024 p 0025 r 0026 s 0027 sh 0028 t 0029 th 002a uh 002b uw 002c v 002d w 002e y 002f z 0030 zh 0031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Ichiro"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; address=NativeSupported; message=NativeSupported; url=NativeSupported; currency=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - de-DE Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\VoiceActivation_HW_de-DE.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search\ = "0"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search\Total = "0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\lsr1041.lxa"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Cosimo - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "410"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\lsr1040.lxa"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft David - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5248260"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "411"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\tn1036.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lookup Lexicon"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Has seleccionado %1 como voz predeterminada."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR Engine (11.0) Text Normalization"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Zira"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1031-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\AI041041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\lsr3082.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Hortense"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SW"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5223743"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "6;18;22"	SearchApp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe
1140	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4752	7zFM.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	4752	7zFM.exe
Token: 35	4752	7zFM.exe
Token: SeSecurityPrivilege	4752	7zFM.exe
Token: SeDebugPrivilege	2172	Facebook breaker.exe
Token: SeDebugPrivilege	3456	Client.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeDebugPrivilege	1204	firefox.exe
Token: SeManageVolumePrivilege	4132	svchost.exe
Token: SeDebugPrivilege	4560	SearchApp.exe
Token: SeDebugPrivilege	4560	SearchApp.exe
Token: SeDebugPrivilege	4560	SearchApp.exe
Token: SeDebugPrivilege	4560	SearchApp.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4752	7zFM.exe
4752	7zFM.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe
4560	SearchApp.exe
1204	firefox.exe
1204	firefox.exe
1204	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1140	2172	Facebook breaker.exe	95
PID 2172 wrote to memory of 1140	2172	Facebook breaker.exe	95
PID 2172 wrote to memory of 3456	2172	Facebook breaker.exe	97
PID 2172 wrote to memory of 3456	2172	Facebook breaker.exe	97
PID 3456 wrote to memory of 2856	3456	Client.exe	98
PID 3456 wrote to memory of 2856	3456	Client.exe	98
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 2024 wrote to memory of 1204	2024	firefox.exe	101
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 3224	1204	firefox.exe	102
PID 1204 wrote to memory of 464	1204	firefox.exe	103
PID 1204 wrote to memory of 464	1204	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Facebook breaker.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4752

C:\Users\Admin\Desktop\Facebook breaker.exe
"C:\Users\Admin\Desktop\Facebook breaker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1140
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9458ab8b-3f09-4b69-98af-eb5ab93330eb} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" gpu
    3⤵
    PID:3224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2360 -parentBuildID 20240401114208 -prefsHandle 2352 -prefMapHandle 2340 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44f4e975-e481-43cc-b0d7-c707afe66467} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" socket
    3⤵
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 3172 -prefMapHandle 2988 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b7633fe-7df9-488f-9d32-f8f7cb70f55b} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3972 -childID 2 -isForBrowser -prefsHandle 3964 -prefMapHandle 2952 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb02cadf-c584-4519-8937-cc7b5fd7b12b} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:1880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4852 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4800 -prefsLen 29198 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e3d6ffd-89e9-4235-b772-0e65897fb3f2} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" utility
    3⤵
    - Checks processor information in registry
    PID:2056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 5368 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f3aca8d-ef9b-41cb-b703-44901b9b382d} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:4560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 4 -isForBrowser -prefsHandle 5524 -prefMapHandle 5532 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2286ae64-9404-4639-a211-5d1f73f00c74} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5484 -childID 5 -isForBrowser -prefsHandle 5512 -prefMapHandle 5516 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8f555f1-a223-49fd-869e-2229fb224e4d} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5860 -childID 6 -isForBrowser -prefsHandle 6104 -prefMapHandle 6120 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2188d87-f4a7-4a6a-8e2e-0cb041c9e2b4} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6344 -childID 7 -isForBrowser -prefsHandle 2692 -prefMapHandle 4712 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d25df79-5760-4dca-908f-55a2f5ca3795} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 8 -isForBrowser -prefsHandle 5828 -prefMapHandle 5824 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9632d204-f4cd-4696-b22a-090b9510a980} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:5076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6648 -childID 9 -isForBrowser -prefsHandle 6516 -prefMapHandle 5872 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {840834fe-3dab-40eb-a092-5c98cc1d8455} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:3740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5416 -childID 10 -isForBrowser -prefsHandle 5452 -prefMapHandle 5744 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57004ff7-9d2e-4eb0-a37d-0542d56ab494} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:1092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6844 -childID 11 -isForBrowser -prefsHandle 5772 -prefMapHandle 6616 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e9d389f-350a-4ee9-8665-2988f227b55d} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6760 -childID 12 -isForBrowser -prefsHandle 6736 -prefMapHandle 6724 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1184 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b83047c-db56-4bd7-81e9-bc692d97606d} 1204 "\\.\pipe\gecko-crash-server-pipe.1204" tab
    3⤵
    PID:1080

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:4344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:6036

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
1⤵
PID:5296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Facebook breaker.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
9ff4d2241f3ecff852a2e358e52c534e

SHA1
b1d4fd49066f1e1be88e4c6b71ab45f577761deb

SHA256
d81ef69422b32bb0fc1ec363b7e182e4fc23ba24ae5a7cebf9269a7651c2a0a7

SHA512
63ecb97faf9b9e21a8718664d75d076a9ff392bb09badc9bf6a40ff03e0619154bebe71995421438f56f46514b2da7decc15a6cf5c998cd173583c00f39fa3d6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\activity-stream.discovery_stream.json.tmp

Filesize
24KB

MD5
8a6c54def20fcec81b417ccd2ad3de0a

SHA1
f11309054769f094070516b952353fd8e203e5d3

SHA256
9e22d89c432fcdc1f644ce7bf3d5f5ccb43f4df9e2fbaad7f4e80b463d63ba83

SHA512
1f0dd601e92e94e197669500af74fd5865df9dffecdeae8529a617e56f1bbc1bfd53903afa2371c667ec464a4cca9b0a13c0c0dcc0897356b352a6259414780c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Filesize
13KB

MD5
edb204b562372f6ed9ef02244443688a

SHA1
21588083da3aa42458c931e18ca417eb9d5ee2ff

SHA256
4cf46ade36020b6a77273fd51913cd90ab754148f403fb67b4f8655f693b9a2a

SHA512
fc2962497266ad19628084d02b902070bd510e8df9ece284c5ebf07f759f02566dc5b892795a214db699dee217687d051a89e854b5dde96da2809a16153ddf76

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\075B8FCF1E4761117058C2EFF149858F93A6A354

Filesize
9KB

MD5
4cd1615590004e823ae5359bf4a6bede

SHA1
e054ffbe69696ed1786086c0dcdf945cc3121378

SHA256
4d1ef67c976a5de08f7310005acde2f0d006f61c64de325d65766864c6612af5

SHA512
8bfe923d4eef4ba272f6563e8e96f10d278bc0b1577001d4ab27bbf51fe99dc4bc86c7bd5eb94c97f13b7b84213744c29125827a547731d7945c1cf7419c94d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\0BABF52A64DC7B1FCCDD563D131A086B80FE77E0

Filesize
15KB

MD5
f21b803407b02ae1db40f479c0107b46

SHA1
bd93caed0cea41fb545b79a606c05c241f52c1a5

SHA256
a311eab232814ac094629e445744ba0920217768b306539acbf83bc511542cec

SHA512
53e370bac158ee17802f6f6010b6150cbb27b0224dc95fed389c89b90bc21a29f797e1c086fbd59de9518c086e6a7101a981b5faacc8a566a9a980e3eace7359

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
556f432ecc34103654f1aceff2953405

SHA1
4688e4630796317fce3381351c40ee301afd1705

SHA256
fa39fa23c5718b187c79833003b44330062f7881d20440174bfbed51dad646c9

SHA512
c289f1f094716ffb3444b85a0c84e724f04ee0a3ff9daaa5c5965ae5d7ea2d5bfb6650a3558c1c3a9c4f7568385c30759a00eb823e87623e9568bce515a4c518

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\2B16ACC15AA680352D12943E950AB926A085A466

Filesize
224KB

MD5
bb19b4e4256349932490526702a365d5

SHA1
2ae7db8f6400f9c7e7f8ac76b7d77abdefdbe990

SHA256
fdf74d4fa44b7597235590f9cfc7fee47c0256ac3580b9deb2bae47a9d3e8c2c

SHA512
d8481be03289920e9bc7c9d1141173c4a32a5ca707fa4d44f8b7cf8ee8343919090712e27996adc3005ba7314d28bcd84e20eea82c2db47223fea2cce56e3199

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\3A8440680AE1D84173A9389A0A86AF10EC334675

Filesize
209KB

MD5
78dc232904534a09a5b8e42ca23ce311

SHA1
32ca969d0e6dc6aaaafb145a46f6d84ece5b5849

SHA256
b1381c477f87d8534159064871d2e8242ce7f70ad17fb7dae56cedcc82ed3642

SHA512
cb471d108ee324a14efad4854e4887db8b997ef94d72060de74bf5044740aadf9c7809341b867837ccce870f93bf5d8934f3fa50e36555065d3dee31faf5dd6c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\4A2A038469704D95FA78F250EDC1C9497E8B7ADC

Filesize
22KB

MD5
35907852ba7664861ddc2ec368ce089a

SHA1
96cc1436b55ffe5327e8f68e53a8c5b4ed8d0ba6

SHA256
bd802b53685a71391c974e0cc97d55cb44a3e6943f7011395f64935dd35e06f8

SHA512
ea06273a882f7707b772f864eb24c21ae0a53aebf001ff8d5f7cc32fd2a1ada442e85abe7012a0f7e9a60d537f9fad1fbf37195a4d50263ce013d62699fb9dc1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\4FF6DCCDCBD43F9460EF360BFB3F482CCCE2D568

Filesize
15KB

MD5
106b3e9cd457c28cc0f3572997d3f8cf

SHA1
1a6b02ba853735cc6e8209af620703898468a1cb

SHA256
9f11f8eeab6a0ed0bab9846ce53b45f103d8c408750336cf264d33d1b194b01a

SHA512
e19442c441a732ef25ab1b34db524ff20c257e87fe51661a4693ae082c4c0b528383d3d46cda4cd3a4cb4743a842d85b70cbe1d0bfd26568f77d049b59361e31

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD

Filesize
32KB

MD5
44b88c85c7cdce67bcc69fcb0eecd951

SHA1
9f141d5cb529fef8f7e001dc1d9cf5582c218962

SHA256
237519a8487b2d66e32d61d903c9a52ebcb46c44b7b5d2376f1901b548bc5555

SHA512
aa5d0e00f92aa2f579d98f728fb7959cd6bfb9c6eb924e40e2008ba5f8dea1d57847c2cd9fdf25527be041c8c2f5bcd8e6b9f2587004178e5276643587e023d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\69612F95A9F65F43D961DB3CC5568725AFBF2BF0

Filesize
39KB

MD5
706d5c64877481108ae6b7161fe243b2

SHA1
8091f3869fb4e838753a2e4dab2c5d17896f2cab

SHA256
6ce4ce00c68ff1aacd813b5e88b0cd3425a1542f6ff2d3260b41beff05ee2742

SHA512
ccc17c8b41cd4a2814db621535d494b5e8408a8136e114e957951db3be075c06cf217519488b4ed5957734688071cdd6908ef5c283d4f0538031c4ce86fb0873

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
10096d402b9156dbe0b4fb33e6989f7b

SHA1
93ef2e00d41769f522c389676bc46ed78e626b1d

SHA256
37c0d92edbdafaf5b3e8f09709746ec552eda994c6ee48ebe249aaf2c13090fe

SHA512
78dfb5a68868bf116310edfd60acc411b7b6a2f7a1148cb62962f8213d8645801158b4bf8a82cd0f6139f0736ac2afcbcb34dbcbfecaf37a26b2bd000fcaaee6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\6EA649AA1559396C72F5DC581B600FF7E4F91FED

Filesize
65KB

MD5
44a50841b45c2e5a157576e651c308ea

SHA1
f21adb8250fec80da484f08ae9e82231ac34ddea

SHA256
2f120a498d10d5dd622fa726e4d7bc37939775788fc2159541a3cb0e67711a40

SHA512
943b4328cf1d123bb037f107f3e817612a74550ff241c95c57605c5c8b51b3dcc772a19d2de7beac48b92ed753a376b42a9f677a85fe93aedd214004146238f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\6EC2AE770EFC3451D85A600B7DBCCE4A25142850

Filesize
224KB

MD5
14cec431b6c06a9a0a0de85048a221fb

SHA1
23511c022d1a67969d12808166e279368f31b074

SHA256
7b4bce64ed35a54c79925a11a0d5a2a57515788dde8533025caff851d5065726

SHA512
e691f484160f445390d9d3f81f4235e224522452c91a7f94c0ad3bc758b33688cda49d3bb5c8bdf143fcec5f034d45ee86854fdbbff02801bc6cf334981bb112

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\74B59C6A1551D74BB99E6CB6A45B631D2D390D50

Filesize
13KB

MD5
92bacb03332fdf1c4792ea5d8bbfc7d5

SHA1
ef5151ea980f0fdbb644d81ca26f865e3a4d2a5b

SHA256
9f2cf59b1dbaa61f768062c37e73eef3ab87b78b467dae785c508b7e1bd2c875

SHA512
a49f4af8e2b843bbcc14b37efed6552e51db00bf7c99f621138a601570771f5a720329a51fec8c51462030406c1514c338017d6073dd72e4d2ab3dfdc6d427c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\7BFCF32544F467F973AF267DF4EB4842EDED0C1F

Filesize
16KB

MD5
a1c999738c3dad276ac60f3f0d635a7b

SHA1
3bafa6ddc33c6879d250ac3729f661aa209661ad

SHA256
f5f144fb1b509ef1f4feda0b981a077678ceb13a5324ea73b910e17b0b006fae

SHA512
ab811c3f62b2085464ed0fca40973b110f8fb80d6bd7782ce93cbe6556366de4bb09f61fd0707c35cfe59892edf51c5f92d9c8ac0373e381e59264d1d056e620

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\8540EC873F08CBAD5DF5121BD3BABF95624B4A14

Filesize
16KB

MD5
de9cf725c8c7c923e7197814ef6710e9

SHA1
b1ad4bdf56d9d479902405b5abe598550560bfda

SHA256
c2ea4de64233dfc19dc6ec4a140fdf499c1160b62a599aaf8b9f30c37fb15662

SHA512
5120bca5a4da077e570f027ac6e6128979295b3d3a2d88446366cfa138726ac9c3f0a0c18ea885f51aa012ebeaf237fd968b36e5d39ad6aa2017e00135532676

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\8AD6F5CF0FEC728921A5A08D73A7BA92616EE430

Filesize
81KB

MD5
6e3c103b7f88fefb6407f70095f8499f

SHA1
f6dd3907275150a6d0ccbf13f7d09be980c67714

SHA256
9063e871a48b22972ac275c328d4d2de681be44542fa927d1eac473af725d584

SHA512
b0602acdacdcf902819310184666696c1ac68d712e3dc32bf676f15b5168182a778e1159d7a1321e15c87fa5af1657a6343572d8d27ae55837954811ba406c8c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\900059D24832A2323066D54B6E7F9700C61BB66F

Filesize
14KB

MD5
52f6d49aeac1703c50723de89a124374

SHA1
59e0b3e44a036628330ffc1709b1bc10e3200221

SHA256
a618ac66c84adcab226c6912df0c1656e9bbcd0d4a1b4d06dc0af649dbf9541a

SHA512
5c01ed51eb33a20fc37455d17262205c4a73428124a1c9079107cbef096682090038332746609217a91f022ef3b80c96a66b23502a2cc8fe942241f7f8262912

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\93017A9FDAD45D76919132AE1266EE85855EA6D6

Filesize
14KB

MD5
8a7b0f9de3cfad5789a86da8b178c6bf

SHA1
d7d8340f682f3dc505c2295776918ea79930d589

SHA256
1ec3ad6898e230f5e9b454fc91712377bdd71a23002b991d91d0dd1aa917a2e2

SHA512
9ee069f07ffcd6db0e4df5a5f31b9beeb9f29afd17da761ace5dfca87c3889969f15321abbf9ee26d9231754897f6249b6e64d4f5541fd82684027236b017ea3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\94F72B6F2D0DC3ED340D601AFA278D214906FBC5

Filesize
9KB

MD5
2aa2070cfd5ede1f78c90a1fab4763b9

SHA1
054ed115da9d7f596b026ef1b3516fbc6ad1b5d8

SHA256
6d30acddf4ccfff6879aaefe0292484fcbfe1a6c2b696db973ea654ce3bf7abd

SHA512
705ad510de3f2599095603852d26f229e5a579f294c594bb9f4f0a814e15bdf02137257e22801be475320dd16bd82441004e3952ccf1b7011fac5cfaccb947b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\9FC8C85689D31525EACE26158B83B464F43A027B

Filesize
23KB

MD5
d2034b05ccffb86f08aa6451a8fd5858

SHA1
867077daeb5a19928621dfa5070c538ff8cb782d

SHA256
6787134786763e6e634ac7177788ae5bb4263b5afc2c2ec63e4d9a4061cee479

SHA512
4a58586d043c467ab7863ad4b0a92ae5fc5817124eaaa7ab8ed7e2709f3bdd99dde12a870a0fbe2aa917d54341fd9d34b11a31d0f680a1d6f6b5cea6a6ea6044

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\A752BE816C32A166B4212612D41570FEFDA0B4E8

Filesize
24KB

MD5
f3f0f147f9f4263212d5ac20b825f9ad

SHA1
fb02a557334ef786a278927e03f1b2bd6f9fe3fd

SHA256
ca37818149bbf63b9ace52c4485b758064d9efbab70c25f72c49cf1dd9497f0c

SHA512
a1b0326572ab7a713014f344abc2ebf3b2c741ce5b0135294909d8d3dd228444a3b235e62e7055dd50f93b331b0be65ade8e3672ae149ff0520fef8f29c3596d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\A9FB5E6047697568641592A7A75CA6ED3DBF5590

Filesize
9KB

MD5
23e89fc20e64cb1725853c3af84835e5

SHA1
6497a0791097ab574adcfe5472e255554cbea59d

SHA256
39efe973ccbc593c88f428761ef0223cd58ee57dc74bb1eb64b6c2491e87a95f

SHA512
f77490b88549fd03f549e6c6d808ae93f4011e16b8537ff4abd27515c7bd774fead132bb04cab0503094d65461ab38284dece89b48c2e25fa8f1338e72e18eb1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\AE6C91A7A94F8219B78F6FB4AEBCFA5DD3A78D91

Filesize
49KB

MD5
c2dc56675cdf9cc4be474691ab0b1733

SHA1
9244b112fb6e4ede007249cebafea75678bff4d8

SHA256
081ff8e6514be40ae9563175fae9a01c9f020b72e15af29ed587daa9fcfc19b2

SHA512
c7689b097aa88191ca708753fb1fd731a737cb907c00121e85bfc3b4407b6ec04c1511e0aba8828bdf811d0e3ef7619c3b3e9a07ce9b3dd529caced2010dc95e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\C423782A482CFFCC385B1989B2E5CE12932F4E34

Filesize
10KB

MD5
4272b1796fc715b1145ea18f775c9a17

SHA1
465b134a6397772ab553881e3326883add46d903

SHA256
31509b7effc6c28e96562d7dfdaeeace89ff675983d1bd4fb6280451ee660696

SHA512
34896810fba930ab214ca2168c342fd8d990aa7b8fc22326c6f55bcaf87076e350c97b949a3a65a4d23c56fc62b8b8ad65c0948915970552c89f1f082e75b720

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\C499BD72763728EF8ADBA3233F4876220BFEFAAE

Filesize
14KB

MD5
004d3ab7818e0690560dc1f02eda6e7a

SHA1
0cc154a93326865d7e41943ecf04930f4dda9357

SHA256
74bfe4c632a3c7f9179b9d1dafb826cb70be32de1f1a64be05f201ae0767dcf1

SHA512
fd4c0e5a4c567b86bbfc66684c5b2879a3c30fdd62a7d2ac3d0b9170e2928fa06905d384ce524e51dc818d72fec0a8485d2ba5118dcf35df9bfce1c7f4cffe89

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\CE30F9E7CB4E0D8AEB054228E581960CC2812E48

Filesize
15KB

MD5
d4619de315c3f7ebd9b17c5ccaed57b1

SHA1
4810c6d1f7f06dd185198ca07650c550189b537f

SHA256
10b1ec31ec1c01fc51904a1523c42d669156d556a6aa02ce28e6f694c53296e2

SHA512
258bcaa5b73576b9718f8aa56112086700c14c79846ffa29bbcccb4040d9f93ee35367f66fd4d017a5c0c0b8d4a4e711b2b5ab28a8087ca00d9e68a9603a1a80

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

Filesize
133KB

MD5
a58183b8bea968980831bcada0468e12

SHA1
53b59ae0644257da21e04e0c3443d0046f3fa8ba

SHA256
ecbd2922eb27ff35432985431a070742b936865ee50107a627f5c54380639495

SHA512
8401e396bd118190f1183456a3583ae18db43ef21f30a2f28c9a19b16423ad2f24a6540a851c9738cbcedf63b53ac6e15b84a749e9ea3dd594349d4823afa517

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\D8C2CFE0485DFC922614553B1999E8CE09530D68

Filesize
23KB

MD5
2518d127755ca22faf8f29d61334299d

SHA1
6d8b3c5265f315dc6aadc464e63a4591a594700d

SHA256
519bc130373b7ef4076d241fa0d82806e71043366abd7e3f0006fa4b4c608e8f

SHA512
05a5b4c4a1ced032c8a881fef3413ce8ffb217b2eaea9354e7ad22fa099b4a71736f4de7e4a49eece11775c517bc1272f923dc4282ef5dadc1ed3c5894686c07

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\DA7C84EA0257C0A76F794634BF46CEC7C3999E4B

Filesize
15KB

MD5
57edf7ee833239b149c0d126b9678744

SHA1
04132bef6788819624373113664ec815294b33c2

SHA256
05dfe217519742ca11b8691b5e7da2a4364b8a80d3b2792de4cf443964813418

SHA512
563d7c82340ef8303ab15f2395d3782312df99f01638a83c2aee272e4ba1749f0fdec6c9ff394d01ae400c65e46b0f2345565167b12b872d8268f436553eb2f9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\EA87465A6B977981215042B94E7AB9FECDDEE708

Filesize
20KB

MD5
b15e07fc0ffa52734968a24b3b906f89

SHA1
afa1dfa4e898bdd49c9d9c306a65682e763e2a63

SHA256
9896fdef62f836d20b8bc4cf144e8f6c96dfa36c83cc4ae2532f941c189813cc

SHA512
bf38de48b0e7185981c34e1b108836cfa7b1549122dfedf40908bf11943214f7f57f8c6a865859ed229c14dd9a6c057c85394111b91f4bd25bb480650ee7e940

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\F0170AF0AA6273CDA9D105CE8905143FE8159A19

Filesize
15KB

MD5
9dfad55aa1a82d8f64073b0e65f3d68e

SHA1
35553896eb4c3621370c83bb0c35934430553192

SHA256
d79eef29bcd73c1c6168a269eb19c7b5e60a038f316ac8598feb090b3819a4a5

SHA512
4c503d91bddad536ed5ef9230a9806c4bd9004b58ef9fd0ded04380f200ee619befe7d1c4b4902425c88af7350733d8dfe35f086bd0585fd5119c91d138d4426

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C

Filesize
363B

MD5
4f97396f301a948f1853fd18775d20b3

SHA1
137c9641ff4235cf194f10abf1768e87dc009165

SHA256
dae683041fdabdb2856f57fdf74e6189804e85177b2c033a032d037a0721a8d8

SHA512
c881a6ae38013516823ddcf2dce910a5268b22aa4a8a4a96246df3583edaadc6755e57ba1e033e89e2db62698be9c51f406ed7be7dd331c323dc77f4a042ce93

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\F21F53293B85556D4D7282B4E507DC37E6D6037D

Filesize
9KB

MD5
907ee28daf28b98f44394c24a884a29f

SHA1
d596e126f3f7d94bc6e3db6ecd2bbf129c4011f2

SHA256
b17ba4ebd8a975d53219afa07b555f96c022086902dbe615c3ea3d4bda5cf8cb

SHA512
0dac4b1ca560cad84b77c321cb4d09528ad44e4ebc1926649cb68252c20798e2dce77fcfb7c71f5198892d79adfb347054fe02292a220c7943959f61c41c035e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\F76F0728DFE5C6096499F97A2C13B379A2DE02CF

Filesize
17KB

MD5
3b1dbdcfbb5383292752e1621222ba0d

SHA1
fa8414b36dd58a5b9c453f05979533f60cf16890

SHA256
016fd33fde9b938b4916b3649bc244dbd8f3636366607491662dcce435204824

SHA512
757fc6c58f1fdfcb86678b0be144d75f428595209209894644fd638b2d2ed2883abdd02cf9f7838f5662929644dbb17f85264c8edf4b572f3d4a76c96e6ae480

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308

Filesize
9KB

MD5
1eaf3eb903d915cbffb564a10eeb439b

SHA1
006a8cc23ae94bf6b8971835631fd6934278cdd3

SHA256
fc5f1986666042ecdc43f79c4f64e1ac020ceb487c11e268931d700a114a02f1

SHA512
bd17506362fb502a0ab5f9651ca46a6487e2dad9a76ee17761d25880ed43d1fa60ec8e5920f3cc37533a26142d5ffb45d046c8049bff3c9450bb070342cbde5b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\cache2\entries\FD3C8B7B2C5FC530AE8D3FC8050677579C3D2E17

Filesize
10KB

MD5
e792c0046dea0695d6cb2dc5043a194a

SHA1
1b09b3db6884a590a8eefa89ebfe8a4313a40e07

SHA256
8dd875e62fa2320258fd9d6104bfd9d66d630261e9463b4d59ab8b09a4d06c1c

SHA512
e0f0542ff41ca2bccfcca085af3a9224ebfdfd5db786cae5da8f02ae47a276ccc0ab2e5c1dc1975994ada190f424b30dc8cedfbd144dc757efb3d9cb71aab91d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
13KB

MD5
f99b4984bd93547ff4ab09d35b9ed6d5

SHA1
73bf4d313cb094bb6ead04460da9547106794007

SHA256
402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

SHA512
cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\startupCache\scriptCache-child.bin

Filesize
705KB

MD5
19bcb67b36d0284fb32873aad9382b44

SHA1
c2ce4e7798ff2373b2b576ded609847b5a472a70

SHA256
df3d383cba8360899ab4f9799f60b21d13514f32d5c5676a94fa985b501377ff

SHA512
0c19153c37e4fbeda74b0e32786a6fe99b2fab6c9691843a569f8613095e72b9d8c5a1128dcdfbc6c236dce4e5a514dce3c96ec17f22d4643120c7e00723fd1b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\startupCache\scriptCache.bin

Filesize
8.6MB

MD5
51e2b60b435eb60f5ffd1134e4066e6f

SHA1
a289984f92fa293f5f8ea3dd6137390469055dd0

SHA256
8c5bbf7ab0d3abbc7b3eb7856e887450aa8c966cc03c986a1b015fc6e68f6320

SHA512
ae88ba80ec0f78f74790597a2e7db2b2efedc9fa238be8e655599de1adf90fe40f11aafe80a83f26387295fd078e72eb400c64d998441569122944cf9afc8bf8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
7bf112f603510708c5707f7400e88446

SHA1
b66a2e70fe76f27d0092a952ff0a9cbe92ef8d7c

SHA256
81ab32c47942918e35173ee338a6d020764fe79d8c544a541c70640cd45b48d2

SHA512
00326788b223e7fe778abd4da9ddcc9159f3373ea3a86bbce3f0aeda72a26582c34796123f17600666707399508cf6c5c6df41cafd8a28616ec63493ae324f25

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
38098fb118638df0a0118395c3a7e7e1

SHA1
1f71a9a1678b353327a0aef5e4c6b10f391138a8

SHA256
4ca755ea5212de953f535f769d103c1df4414a1e2fa3e656a2f63a8a352d7b50

SHA512
974047df6bafc8b7d35e0dc951e8825fb8b3d089260ddc5d2c52f27c381a38349fa37b338e15f35ba7e52fafb7ef6cde205d0dbbed9cdf63e85465c0d5936251

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BJ16TPM2\microsoft.windows[1].xml

Filesize
97B

MD5
b1768b28a7c1fd8652aa6b4c520f98fd

SHA1
482085b7fedb174d4e8a0d8ec89e20d46b4b5cbe

SHA256
8829d1f75f2b5717294edd81ceb788c666df4509a5d762fa70e9e5f4cec00c76

SHA512
82836f34a78d2be4325a6340ce53dc66d83489a6cf688474a8a0ec62c95e0cb2770d3779399affe50ff2daff9544dca264a2269af47d1b98aaeab9f9c78430a8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{15e8e85e-46e3-44dc-96bb-47ff64131424}\Apps.ft

Filesize
1KB

MD5
6c78adbcc2f3ba7a2ad306983176414c

SHA1
484787d9aef671594b4d91b6c7d2d5c215f46260

SHA256
8f2abe81c4d834b96b5e39b504949cd04aef23e290309b413f501b396efd381a

SHA512
69bb126822ee7008d30135f7c216bf364e8e70ec5ca09cff58671d3c29081f467719bedb172cc14962aeeef22c34fb7e4c4a6aed26c26691a4cfef3816138c69

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{15e8e85e-46e3-44dc-96bb-47ff64131424}\Apps.index

Filesize
879KB

MD5
5e4ec42046e35b20c1b8d97c17926572

SHA1
d0f371a97b676240bd90f9fa1a0b14f97f9b1016

SHA256
6a8c0c8cc58a866d0b874926f0ff1e2034a60bb18a2c584dd7f100be49c0febc

SHA512
d8bc115f3e0632aa6df6d1ca949e53a5724eff26c9d42d90686df0aea777a00b6c3d1738adf7807c7c752f5f702c4bce1bee158d1f9e765a0148c960ea0113af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b173a5bf-832b-4600-9344-88b0e95e5a36}\0.0.filtertrie.intermediate.txt

Filesize
1KB

MD5
8609241ac301971b563b8864447f5fbc

SHA1
81b1e9382f7012f2441efcec40a5aabf46f34397

SHA256
94d0c4ea1f705b557a8dd983931ecab83f4d19e691669f2723781d406d38a282

SHA512
e536d2ae24ee17df34e28bcd1220f20901ec9b19a6f69b0c87f82a6535c813737681496927d9bea0b90e33b7c8236c77790a55d9a8514f5084ed3ad16d71c554

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b173a5bf-832b-4600-9344-88b0e95e5a36}\0.1.filtertrie.intermediate.txt

Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b173a5bf-832b-4600-9344-88b0e95e5a36}\0.2.filtertrie.intermediate.txt

Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4231d96f-271a-4a64-ac3e-c0937fbc4597}\apps.csg

Filesize
444B

MD5
5475132f1c603298967f332dc9ffb864

SHA1
4749174f29f34c7d75979c25f31d79774a49ea46

SHA256
0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

SHA512
54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4231d96f-271a-4a64-ac3e-c0937fbc4597}\apps.schema

Filesize
150B

MD5
1659677c45c49a78f33551da43494005

SHA1
ae588ef3c9ea7839be032ab4323e04bc260d9387

SHA256
5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

SHA512
740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4231d96f-271a-4a64-ac3e-c0937fbc4597}\appsconversions.txt

Filesize
1.4MB

MD5
2bef0e21ceb249ffb5f123c1e5bd0292

SHA1
86877a464a0739114e45242b9d427e368ebcc02c

SHA256
8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

SHA512
f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4231d96f-271a-4a64-ac3e-c0937fbc4597}\appsglobals.txt

Filesize
343KB

MD5
931b27b3ec2c5e9f29439fba87ec0dc9

SHA1
dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

SHA256
541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

SHA512
4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4231d96f-271a-4a64-ac3e-c0937fbc4597}\appssynonyms.txt

Filesize
237KB

MD5
06a69ad411292eca66697dc17898e653

SHA1
fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

SHA256
2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

SHA512
ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133751757386293882.txt

Filesize
3KB

MD5
6c7c5879f1c75b60ca6fe7048fdf88b6

SHA1
e3faf0e19132003dfc8617a40933f760ec6b64c4

SHA256
5391afca6e19b795f4790c36b762d967859b8dcab7f34f40cd3e9d02fb8ab74c

SHA512
23a865f4b8d9b04b85d85c7e81a24ca6e28b12ad74acc9256ac564b437adeb0c64cb5fdfc723dde91f38a6c9363e63350791eba9d9217d67b9b387ea8ec209bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Filesize
689KB

MD5
2dee0ab82c5db228dee2de2fe0d82eb3

SHA1
c6231ad00bd775537fb422a86bfe2b5754e9b91d

SHA256
0e01a47917642eac553b6d0feb6e97b398f7af84c5ffc74ba35ca66d7a341d39

SHA512
c46ae09aab1f240ba384044ef46240a4cb02b6144b0403d690ff7ddcf79acc67da345c98254ef5436a4008fb419c889af43489fedf86e8ba822128365f30763f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
2KB

MD5
811d11cd22b29c71c67f2948778d2a20

SHA1
e8d0c088e050cf5e917bdffd9e3883445a3f48b8

SHA256
0c9081643dee6e9a6cd3561fdeba820beee7da794d00dd07352474025b0b3532

SHA512
aa1a8e67a5925213c94bbb96a8f3589aa3538305c6217adf288db68b4b3a2238ef53a3ef39d91ab9af8687f5581d6910eeb48d16909046dcd02e46f18e6797ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
2KB

MD5
b9ee95f8df3397c2ee3e2e830234c8f0

SHA1
a1cdac68e1a1af07f748697ad907237115a90ee1

SHA256
1278d7dccc721096cdbfbfc1c8b29dabc1fb14a03063da6f4d8066b3c070f304

SHA512
99c1dbc6e67a5aa25e7a82fe5b2af321c2780e4330a64d7d22393e8a92efa583a7407676bd4a58ad03ff2fed7cbd2cdfab792a7a55cf80a7f6b875fee4eb44b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\AlternateServices.bin

Filesize
7KB

MD5
627728dff1acf2fcd18778de9342ef92

SHA1
a73ac3168e8dd8a12d006026b8e61eb8ee85227a

SHA256
d31077b194d0515f5a5d750b294c94017610497114af3f5427d8d106d87accfd

SHA512
eeb0c37ca8c509d9e66d7cc4b2a33b0c332df757b28a96f662d20dc8a8284adc3724b367d4481d45c1e49b4cfef0de3791c312719facd2a07120225de940ce11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\AlternateServices.bin

Filesize
15KB

MD5
4bc76811e75f4fd88aa408fe493ebbfe

SHA1
a84ec8a075dbf1d5fed1af0156e75da1e010ce1d

SHA256
b0f1e8a4329aa3b196b85c1596d7428e8e62b80079cb5e0435ecb4de49c7533c

SHA512
53b93b5e49ef82ce4534d4086dff3b8ce55163db7bd395f5ca6412d528867f5ca53a11099796f8623eac309d655f731da0de66d0a35d0d055cdf6e9d6dcb7362

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\AlternateServices.bin

Filesize
18KB

MD5
b35db623b76efcfec5c613a4ef9eb1f4

SHA1
64ac73b2059f4155ae7117c217ec477feb74bd30

SHA256
7fa62e709ee1e7372898516d41f1718c6aa982ffa38f0f348c89549bf98ca3ae

SHA512
0058343cab4506daaef8a4cdfb652ea622e8cc028c61c17757179c9e112c0f309fb9d543a616f5ebac777dff6ec490ad39952bdc4615761db6dd80ab09d7073a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\SiteSecurityServiceState.bin

Filesize
1KB

MD5
fb1c196a7caef2f6545f8951712d45e4

SHA1
de15a7e99d65775e43d502910f9784c585038563

SHA256
fac44b85837321d4d414c21d59c43253abaf03d72b257674715e7da4ead48d46

SHA512
c581e7694bf4790ec4f4e93337077d5492e8274c4f5f81c8b074dc3ce8f62da5f7c89b53c629e08c7512643f77a2d764c13102034e4835682d817daf52c7b811

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\db\data.safe.bin

Filesize
25KB

MD5
08578a7dd14d6a85777b20b8bd60dee6

SHA1
3832616a65af1151dd8b9b16affd429804d19ecc

SHA256
f43b2c259950a74fe1a1477ebbf6bef41b8973f106f45c00e039c4ce2999ee6d

SHA512
bc02c3d86a1748b047980ced7790c23ba9bce290f58ede8bb4ea0fcb263913b6baee9e7e1d1f38e4398d00e2fc81e9978c96178922cec60f2e5320a4e18ae3d8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
068c6339f18a4e196d6d2657191fc936

SHA1
eeea027c44544f352e9d4901243475f75383b047

SHA256
7a9077012b19a1d546e013fb8d3307b7e8a240eafd16ffed6591a53fd3239057

SHA512
3747e61d7a13196f1eda5c2169f440ef28e4b112f4b42f4c75fcd01b5a8d330bc45785e4c6ad791be4e6cdeae2190f1430ac47647f381a58c0d69c347fd1e2b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
95c4fca28cf697399cd3858293458be3

SHA1
12f1103b5b803bd7741dd675ae39bcfe90865e1b

SHA256
22e870599b4444435d7465a6fe60303302b69add98862fff8191ac7ee39d64dd

SHA512
f5dbd8de5b810446001ab2d1143e10302aafd69c0036de49a09da4c7ea96437232659cc6fc536b4f3fc4c29b36c1a6bf0d34144b1c05b360e573920461b628f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
b20132b8f792c6aae5827907a3bba4a9

SHA1
9bcb17ada19c530c0679ac8cfdc43f895908bfce

SHA256
00cf6a687dc3560d866c7e3442d92f107ff8d9a1ce6262734af0fad5fea0f3fb

SHA512
85606c18644f96c6af61bbfa02c3f70b464c21e6733dda3179e10fadbfa01c15302d07e92563662c7d22606051ecbd919c9a9edf9561fdeb63fff6884e453872

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\events\pageload

Filesize
481B

MD5
0acd4504471605db4cddc7005e920ab4

SHA1
88c802868e4ac99d3a9ec3eeb8d1468a8bad4272

SHA256
f6b11d2179f0134a5828f3506d5685e12fcff8bf8998bbdebc203c65d43061bc

SHA512
1c1c22f29f57018903bf5b82fcf8cd08dcbcabcfb9a1acf0944313003b9cab763d466bd8b4f234614dc3021f33e447b26e376055ff9080e4da5824df5004744d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\pending_pings\990d748d-7254-4dce-8750-3458a64ffe8b

Filesize
982B

MD5
db5dcc9630186432a40a1fe85d481c4e

SHA1
67943ebba4f256f27d922d76d426431b26bdd3ed

SHA256
90e51d9167cd03eba73d5567ac7b9832410baa9048937b291a6410a761626408

SHA512
9d6ad669cf96977ddad6a281238cd1a79c6375cff61f47144f2cc713fc7d6dce781e2228ae126f924e348914b0ecd3b514f382a44760c4b18c9de29facf9b05e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\pending_pings\9e49ddd0-2a78-4967-8f47-a831d5c52207

Filesize
671B

MD5
ba60ad664e5c33c616e26eab461603c6

SHA1
b2b64e6713927b949261c1befc13d2c47fac5963

SHA256
ae092298d7a6392c0842f952c630a9323c19d5d24d134b0d84085af45fb298d6

SHA512
bf71ce7d7404d23dfec957a78bbe99ae2c29efb6b743e118540496716deab4477b78cb8a1d88710d3a0a766475f7db1a273d4b65f9d87b21b83d2430bbd28caa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\datareporting\glean\pending_pings\f6d30578-0672-4de8-9e65-dbcb501cde32

Filesize
26KB

MD5
9cc2d6b41b8b36f61bc97504ed02a953

SHA1
e7d51ba40ffbee5446a43bd7f7f28b009e90cff7

SHA256
0bef7db311db90e0d1655bc27aaeb3066b02b2afd1280f0da2c7c17969005b28

SHA512
8f94468c302a0e2841f7c0b86a7ad7bb5b1ff77d40c9041cec93fc76debb6be53b47abab6b5a77872ae5e23d1d9d7ff1c7aa37dc84b10d57382ffda253a53db2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\prefs.js

Filesize
10KB

MD5
b500d27a0216e75a973a6f4c2f41feba

SHA1
8be9db37ec5d0039b11396ae45f64abe933d5b83

SHA256
033c709e978440b978d4efb28c07688c1c09ff3add9b5858d9f875f4f6341bb0

SHA512
661c6e9cd33ae6afb2200f909126450bdee828e8de38088444245f67b59e1a22e244de131eaf6721cd5c436a324ef383de6b97c09400e5957a34944ecbf62c3e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\prefs.js

Filesize
11KB

MD5
d8acc7176a02d6e4ae2fa5e14bfa513e

SHA1
dbef6fbfa4f2e997e4847cec464482c5cc624f2c

SHA256
9b1ea29191e73f8930bf84ed0cb37bf812148067561cff53d39105cfbc55e1e7

SHA512
680b31dd2fe56072b0404ce24d924cc42c5bd5b01a97341a14d0e1ec2be444199842170c17105d2e640fe70fba8659fff053f1d1c27a88aab07880cb086a1c63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\prefs.js

Filesize
10KB

MD5
9d164188fde49d0ac0f72f5b7f7163a8

SHA1
8920cb7bcc02e967f528ddea2ce9e9e72e0354f0

SHA256
18e6fcdfea93e8c2699b9a89f15a9e260395833d5ae0e8ab83aae1c4205ae6f0

SHA512
81187e93a189b15615d8569d655c5b3b774118bf393c0270a3dc8a67aeb950a9f177d223a3e608b19f9917dc14d389445717f4430e7cd975cdff5c0a667482b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
6cdf76f697d4db36c951501920312923

SHA1
12f1148c54aeca6b3e4cc42cf70f44c30f30e27e

SHA256
8d3c9b754652707f681081f917c2f13bf9d61aeff16f50977004bfbcae45fafe

SHA512
07b3b80403b9229f2f780d1be6e58db53cd3ce941a83369fc6dbd15b36564b28d426c23a6ca9844480f9fa4965e5d8604cff045d66bba91a3a4ab559ae704b8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
96a87048c503fdfcd6749043b9b1a8a9

SHA1
cb3f0abb374b204a61c9cf6f5ac24c13ff24a21f

SHA256
7e3c4bc8fa3c5d3c34c920cf62c35e77d5b495316fff21e468eb86bc47f0e931

SHA512
3d7e6c9570abd5b7bc91d89a2ff8ed585a0b1d6416d835350e3f014f3b0e73000bff4909e3dd1128403d7369394abe5f0df3d2158ab0288e0141cca8bbfa613f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
727640d16b9254f3f141c8829ed2b4db

SHA1
a44efb13f3054815ccb4cfc2142ddcf0ea53a87e

SHA256
508f39b86e87e70d31d15a0bbff9ff9ab3c7c8819cdcec565f9794510501631d

SHA512
3fa728e67c5d2de69492a474bce9ae83dc2da33f1f67cb3af557cd93c8926450ae261ed0ed14580c148481706036acb5920ef1aea08a6bacce3365fe430ef37d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
8a1273b1795f7a2aaac161428d578bad

SHA1
87c5e65ff4d51fc223e6bfee9e5b507f1960ee89

SHA256
06eb9e8bfccdb6bbaa27c733380b3727f57cb2d5a0ec4586b80e371390586573

SHA512
1569d814b5c5da819c842e57fbe5633399a1edb3331dbb8c29b6817ed2fa6b3de187f1bd7c1b9d855f617294150a4accce98f5e942d28805bd5a5da02df4088a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
b761e748c8483444f58cb84150e26808

SHA1
82daf07b982eaa5d7bd0be1e0e9a5fe086f69f94

SHA256
fe38929c07acc3e89c2ccd245c3c566febec88989723d3272a831bda1e1cfc85

SHA512
fc9a0dd36c2e2515f5d06e39e2c6f314bb3ebf7a21378cf3582c1d4c5cdf15149fe27e8d47592d0e3c39144f335eeda2e8878c796ee5696d632386990219994a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\storage\default\https+++www.google.com\.metadata-v2

Filesize
52B

MD5
1c025874093cccc86803d8abcb8e86a9

SHA1
ccc0dceebb5b1289411cf649262c19c0bcbce126

SHA256
94c55eaeac74c6536f6d7b82e8ff4cba00e637f8b932dba98d12d50e1b4c242a

SHA512
382d1892827b61ae208b084a79fd57b287138b7cd74678b6ac213147618d46b5144562365932d90e9e83462f79041cd07d4a546aaacacf5d51dd89a7cfd5d3fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\storage\default\https+++www.google.com\ls\usage

Filesize
12B

MD5
3b309d898a7f787bb4fb33b502698d4a

SHA1
7a737cd10592364f364de1096ef4565e0749d7b5

SHA256
caa0e9dc2d6babd2b18eef04758cbc409ad873c40849cf31b8bf1db1d74a7ab0

SHA512
faa248aae3bddadea4e2393c12c5c20389574d9052b2a086d40098fe66b585db1adad61d54dd85452ff89d7230f46f0c10ef7b36141b639b47c424e48126f3cb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
592KB

MD5
c0108bf5b8e9ba79f2a27c83d665323a

SHA1
aac1ab5b038d44d9cfc7dd5c185406760603b0e5

SHA256
c0ccd025b604643d6eb16e6862526e725fbe0ca3217eabac8cf192c145ab6c9c

SHA512
b699ab94e03f5f3fedbb1b769928105e4049f0704e008f8321ba5ea1f470b4455e45e24a04601683c36c2c002085b33fd7697911ae8f6e520e96b5e97ecc9445

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e2dtnzpu.default-release\targeting.snapshot.json

Filesize
4KB

MD5
59152ba46c3993b9295650bc64376549

SHA1
65e96e9ca04ca3ff7d763436cb09eea86ad2dc78

SHA256
4d736ccb2f6fe40a3f7a4ef49b1b7b5c09ded60f5ddf0666dd9f8b60f17c9f30

SHA512
4899d4918dc5a18f80ba5beba7f59a518ff5bf318a05669c1c0c6e4b2c52e5f532c477b842a84701f66c58ab6a5713ea2b06d2e97d183e340ea2d30f38df406c

Download Submit
C:\Users\Admin\Desktop\Facebook breaker.exe

Filesize
3.1MB

MD5
54015452b4c7ca1af1e48c57d8169ae8

SHA1
31fd25eb9d5142f0cd3c281ce0617c9843ee6088

SHA256
d65476ae21d3f06713febd1ec371f89832248bee5d8fd0717f515df2d4aad2bb

SHA512
6ad3294c6eb7b12ca3538b85835ca36c9bf523b474db26268900ccee866e32067e2b2b2a872b4360c457b759de562572503c7f9ffdbb4ee836994154ec01ff55

Download Submit
memory/2172-6-0x00007FFC3C740000-0x00007FFC3D202000-memory.dmp

Filesize
10.8MB

Download
memory/2172-9-0x00007FFC3C740000-0x00007FFC3D202000-memory.dmp

Filesize
10.8MB

Download
memory/2172-5-0x0000000000770000-0x0000000000A96000-memory.dmp

Filesize
3.1MB

Download
memory/2172-4-0x00007FFC3C743000-0x00007FFC3C745000-memory.dmp

Filesize
8KB

Download
memory/3456-11-0x000000001C1F0000-0x000000001C2A2000-memory.dmp

Filesize
712KB

Download
memory/3456-14-0x000000001B1B0000-0x000000001B1C2000-memory.dmp

Filesize
72KB

Download
memory/3456-15-0x000000001C170000-0x000000001C1AC000-memory.dmp

Filesize
240KB

Download
memory/3456-10-0x000000001C0E0000-0x000000001C130000-memory.dmp

Filesize
320KB

Download
memory/4132-775-0x0000016A430F0000-0x0000016A430F1000-memory.dmp

Filesize
4KB

Download
memory/4132-750-0x0000016A430B0000-0x0000016A430B1000-memory.dmp

Filesize
4KB

Download
memory/4132-768-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-769-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-770-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-771-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-773-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-772-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-774-0x0000016A430F0000-0x0000016A430F1000-memory.dmp

Filesize
4KB

Download
memory/4132-753-0x0000016A430C0000-0x0000016A430C1000-memory.dmp

Filesize
4KB

Download
memory/4132-776-0x0000016A43400000-0x0000016A43401000-memory.dmp

Filesize
4KB

Download
memory/4132-777-0x0000016A43150000-0x0000016A43151000-memory.dmp

Filesize
4KB

Download
memory/4132-778-0x0000016A43150000-0x0000016A43151000-memory.dmp

Filesize
4KB

Download
memory/4132-754-0x0000016A430C0000-0x0000016A430C1000-memory.dmp

Filesize
4KB

Download
memory/4132-755-0x0000016A430C0000-0x0000016A430C1000-memory.dmp

Filesize
4KB

Download
memory/4132-757-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-752-0x0000016A430B0000-0x0000016A430B1000-memory.dmp

Filesize
4KB

Download
memory/4132-767-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-748-0x0000016A42F70000-0x0000016A42F71000-memory.dmp

Filesize
4KB

Download
memory/4132-713-0x0000016A3AC40000-0x0000016A3AC50000-memory.dmp

Filesize
64KB

Download
memory/4132-730-0x0000016A3AD50000-0x0000016A3AD60000-memory.dmp

Filesize
64KB

Download
memory/4132-766-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-765-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-764-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-762-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-763-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-759-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-761-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-760-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-758-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4132-756-0x0000016A430E0000-0x0000016A430E1000-memory.dmp

Filesize
4KB

Download
memory/4560-780-0x0000016C08B70000-0x0000016C08C70000-memory.dmp

Filesize
1024KB

Download
memory/4560-781-0x0000016C08B70000-0x0000016C08C70000-memory.dmp

Filesize
1024KB

Download
memory/4560-782-0x0000016C08B70000-0x0000016C08C70000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads