hxxps://drive[.]google[.]com/file/d/1LtRfa9VF03BsbCoRfpKvrhwZYc6lPmkP/view?usp=sharing

Resubmissions

11-11-2024 13:09

241111-qd7b7aymg1 8

11-11-2024 13:08

241111-qdmmsazela 6

Analysis

max time kernel
644s
max time network
630s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11-11-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/1LtRfa9VF03BsbCoRfpKvrhwZYc6lPmkP/view?usp=sharing

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 13 IoCs

pid	Process
5984	7z2408-x64.exe
1940	7zG.exe
4656	7zG.exe
1484	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe
2524	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
5600	Serum_x64.exe
3580	Serum_x64.exe
5548	Serum_x64.exe
5312	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe
3468	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
1076	Serum_x64.exe
3496	Serum_x64.exe
1512	Serum_x64.exe

Loads dropped DLL 9 IoCs

pid	Process
3536	Process not Found
1940	7zG.exe
4656	7zG.exe
5600	Serum_x64.exe
3580	Serum_x64.exe
5548	Serum_x64.exe
1076	Serum_x64.exe
3496	Serum_x64.exe
1512	Serum_x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
8	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\Xfer Records\Serum\unins000.dat	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\is-NG6EL.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\is-OUJLS.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\Resources\Snapshots\is-44A0L.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\is-3KPT3.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Common Files\VST3\Xfer\is-MBJEV.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\Common Files\VST3\Xfer	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\x86_64-win\is-TCR85.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Xfer Records\Serum\is-PBCC3.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2408-x64.exe
File created	C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\Contents\is-TPQA0.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\is-1CDH0.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Xfer Records\is-AEJQT.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\Common Files\VST3\Xfer\Serum.vst3	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\is-MIEBU.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Vstplugins\Xfer\is-IMB5Q.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\Xfer Records\Serum\unins000.dat	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\Vstplugins\Xfer\Serum_x64.dll	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\Common Files\VST3\Xfer\Serum.vst3	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Vstplugins\Xfer\is-19CVI.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\x86_64-win\is-IAP24.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\Vstplugins\Xfer\Serum_x64.exe	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\Common Files\VST3\Xfer	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Vstplugins\Xfer\is-BG7KI.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File created	C:\Program Files\Xfer Records\is-QML9N.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\Vstplugins\Xfer\SerumFX_x64.dll	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\Vstplugins\Xfer\SerumFX_x64.dll	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2408-x64.exe
File created	C:\Program Files\Xfer Records\is-5FNVR.tmp	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4074627901-37362009-3519777259-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 297287.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
3152	msedge.exe
3152	msedge.exe
4980	identity_helper.exe
4980	identity_helper.exe
5220	msedge.exe
5220	msedge.exe
5728	msedge.exe
5728	msedge.exe
2524	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
2524	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
3468	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
3468	Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3932	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	1940	7zG.exe
Token: 35	1940	7zG.exe
Token: SeSecurityPrivilege	1940	7zG.exe
Token: SeSecurityPrivilege	1940	7zG.exe
Token: SeRestorePrivilege	4656	7zG.exe
Token: 35	4656	7zG.exe
Token: SeSecurityPrivilege	4656	7zG.exe
Token: SeSecurityPrivilege	4656	7zG.exe
Token: SeDebugPrivilege	4856	firefox.exe
Token: SeDebugPrivilege	4856	firefox.exe
Token: SeDebugPrivilege	4856	firefox.exe
Token: SeDebugPrivilege	4856	firefox.exe
Token: SeDebugPrivilege	4856	firefox.exe
Token: SeDebugPrivilege	4856	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
5984	7z2408-x64.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
3932	OpenWith.exe
5600	Serum_x64.exe
5600	Serum_x64.exe
3580	Serum_x64.exe
3580	Serum_x64.exe
5548	Serum_x64.exe
5548	Serum_x64.exe
1076	Serum_x64.exe
1076	Serum_x64.exe
4856	firefox.exe
3496	Serum_x64.exe
3496	Serum_x64.exe
1512	Serum_x64.exe
1512	Serum_x64.exe
4856	firefox.exe
4856	firefox.exe
4856	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4424	3152	msedge.exe	83
PID 3152 wrote to memory of 4424	3152	msedge.exe	83
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 4192	3152	msedge.exe	84
PID 3152 wrote to memory of 1232	3152	msedge.exe	85
PID 3152 wrote to memory of 1232	3152	msedge.exe	85
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86
PID 3152 wrote to memory of 1952	3152	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/1LtRfa9VF03BsbCoRfpKvrhwZYc6lPmkP/view?usp=sharing
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb118046f8,0x7ffb11804708,0x7ffb11804718
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:2900
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff68e515460,0x7ff68e515470,0x7ff68e515480
    3⤵
    PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,6448904610311599732,1193595290530113437,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:5852
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5148

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap22143:124:7zEvent15272
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap26817:124:7zEvent26074
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3932
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.nfo
  2⤵
  PID:2268

C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe
"C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484
- C:\Users\Admin\AppData\Local\Temp\is-17E52.tmp\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-17E52.tmp\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp" /SL5="$40160,202760713,792576,C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- - C:\Program Files\Vstplugins\Xfer\Serum_x64.exe
    "C:\Program Files\Vstplugins\Xfer\Serum_x64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:5164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2652

C:\Program Files\Vstplugins\Xfer\Serum_x64.exe
"C:\Program Files\Vstplugins\Xfer\Serum_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3580

C:\Program Files\Vstplugins\Xfer\Serum_x64.exe
"C:\Program Files\Vstplugins\Xfer\Serum_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:5548

C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe
"C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5312
- C:\Users\Admin\AppData\Local\Temp\is-VQ76U.tmp\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VQ76U.tmp\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp" /SL5="$100062,202760713,792576,C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- - C:\Program Files\Vstplugins\Xfer\Serum_x64.exe
    "C:\Program Files\Vstplugins\Xfer\Serum_x64.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1076

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1192
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60f3dda2-68c6-42ee-a1c4-c27c0bf523ff} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" gpu
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f1af170-c841-4117-85ff-a1ee5986909e} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" socket
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3228 -childID 1 -isForBrowser -prefsHandle 3416 -prefMapHandle 1592 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d6a0348-102e-4011-a83c-a73d1f420d2b} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:5668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4212 -childID 2 -isForBrowser -prefsHandle 4204 -prefMapHandle 4200 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceabc00b-b0e7-483d-89b8-a8b67207b702} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:1584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4856 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4836 -prefMapHandle 4820 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bb0038c-3405-4b80-99c2-b728fae68a3c} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" utility
    3⤵
    - Checks processor information in registry
    PID:1928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5412 -childID 3 -isForBrowser -prefsHandle 5332 -prefMapHandle 5320 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15c8f9c3-1ef4-4ded-b7ef-c28aea3ae1b2} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:2024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 4 -isForBrowser -prefsHandle 5572 -prefMapHandle 5576 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {209755eb-6b66-4686-9c0a-a8cec6f5df6d} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 5 -isForBrowser -prefsHandle 5832 -prefMapHandle 5828 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ed25058-2395-4067-a6d8-5ab6c385be6d} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6160 -childID 6 -isForBrowser -prefsHandle 6100 -prefMapHandle 6164 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdb084d9-0285-44e1-9161-da0da519ab68} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:2588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6276 -childID 7 -isForBrowser -prefsHandle 6352 -prefMapHandle 6348 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f2c20db-c7ea-4960-bea0-2de4618a34f8} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:5596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6704 -childID 8 -isForBrowser -prefsHandle 6584 -prefMapHandle 6588 -prefsLen 27261 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {365e5ac4-ecc2-453a-aecb-d8494d8c1ff4} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:3580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7040 -childID 9 -isForBrowser -prefsHandle 7032 -prefMapHandle 1232 -prefsLen 27451 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91d44d1f-a5fa-4711-adea-88597d5cc69f} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4772 -parentBuildID 20240401114208 -prefsHandle 2752 -prefMapHandle 4676 -prefsLen 29820 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa1281b3-2df3-4877-b842-303799a0cdee} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" rdd
    3⤵
    PID:3616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7196 -childID 10 -isForBrowser -prefsHandle 4440 -prefMapHandle 5128 -prefsLen 27827 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b60e239-079b-41e8-afc5-405e8754be66} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:1192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7316 -childID 11 -isForBrowser -prefsHandle 7324 -prefMapHandle 7328 -prefsLen 27827 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6db3fe7-46a6-4513-b64b-5f3352166e9b} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:5920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7404 -childID 12 -isForBrowser -prefsHandle 7324 -prefMapHandle 7584 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d6923ba-740a-44d4-b717-3d4173359076} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:4844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4816 -childID 13 -isForBrowser -prefsHandle 5788 -prefMapHandle 5044 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10f3c98d-1582-4fd2-89dc-42587eddbc84} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6432 -childID 14 -isForBrowser -prefsHandle 6376 -prefMapHandle 6396 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c89d97f-2445-4897-8bdd-72ab309241e6} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7540 -childID 15 -isForBrowser -prefsHandle 7320 -prefMapHandle 7196 -prefsLen 28048 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49a08263-0051-4fb6-b53f-15bc1795c848} 4856 "\\.\pipe\gecko-crash-server-pipe.4856" tab
    3⤵
    PID:1752

C:\Program Files\Vstplugins\Xfer\Serum_x64.exe
"C:\Program Files\Vstplugins\Xfer\Serum_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3496

C:\Program Files\Vstplugins\Xfer\Serum_x64.exe
"C:\Program Files\Vstplugins\Xfer\Serum_x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
d346530e648e15887ae88ea34c82efc9

SHA1
5644d95910852e50a4b42375bddfef05f6b3490f

SHA256
f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

SHA512
62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\Resources\Snapshots\56535458667358736572756D00000000_snapshot.png

Filesize
69KB

MD5
d4f509bc943e6a63f8341b59f1f7bdba

SHA1
f2509a1591226e328575334c0b1808a298a428e6

SHA256
d4738295f8ea169eeae88650dfaf4fa8d08801133643edff7e977bb154334de7

SHA512
e3937b9b00f23cce9bde9457400e6bd5f67a679826c490180967f91977ea13de6488fe3ab9079948ad9e068826dade5eb491bd3b9adba3e2d42a504e005a0a6a

Download Submit
C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\Resources\Snapshots\56535458667358736572756D00000000_snapshot_2.0x.png

Filesize
192KB

MD5
ac34bf9ae51a9936b5c585e5cf946f92

SHA1
65ea711196c7b09a1f78017302147896bcebcb1d

SHA256
c4f156484d83f02c8e8951da5bf09e080abcf829abfa87a2cf3e0176f19a6df8

SHA512
d0bbd633173d5d5e2172036e42ac7ebb5c3220f5a36f9c4a8e5cf53078854ace6c938557e7362972a2651d7c0b6079c290b1581ae191c2efccc1417606be1ecf

Download Submit
C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\moduleinfo.json

Filesize
1KB

MD5
b3a2de66266134954a7321311f9862d7

SHA1
108b15951dada45165f72d42e22aef2f8ff8107f

SHA256
96f5309beb4a6e9cb37a15a90b275da7e4a9cf1db3b9cbba87e3252cd4652e52

SHA512
8ea4994d84c6c9e4fed26d447f4d93b8b466483c721a3108566d366f96736a5c425ea7b42042374156c747e0ff003a61a691bfb912647f99191d0db2b34e8b69

Download Submit
C:\Program Files\Common Files\VST3\Xfer\Serum.vst3\Contents\x86_64-win\Serum.vst3

Filesize
7.9MB

MD5
3ad5239a43432ebab3000ad0bbf672cb

SHA1
44c5b8f0683da82e49346ff90aee9b3b0525b36c

SHA256
115d59295e11bc37d9b8bdb0d06f8e026015881eaa35b8de10a3bc1463fb9a89

SHA512
1780e1c75d1f28d18c4205806da4e58da62c2d4c01e048289d3299ea6dcf29fb3e53f27e7a29257dcd46ee38decba90972f2b2deac509b544967fcadb7f018ba

Download Submit
C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\Contents\Resources\Snapshots\56535458667359736572756D66780000_snapshot.png

Filesize
70KB

MD5
30f0435185f66167f4bb6e248d15e0bf

SHA1
82ad7194eac758ba91027e68ae1e9ba8c35a1917

SHA256
22d8399d391ebf3bb5fb8353acd2d4bdc85813865162273614cd577c0a0ed84a

SHA512
1d7ae9f97b484c7f4ccfc46a28dbb814d729a419893a73829a44ac41b5101dcc27225a4025484736ff25c4435afaa6da614544c51242ca195f7bb815d9158107

Download Submit
C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\Contents\Resources\Snapshots\56535458667359736572756D66780000_snapshot_2.0x.png

Filesize
211KB

MD5
e9412e6e32074d0dd93ed6bee903ccec

SHA1
455b2916c6ccc50f9de098cf922f0cb17a89746a

SHA256
3171112193835c4e9e5717d9fe4a278878d2fec5a76115886a6c636f08f15416

SHA512
9e969f84e01691b3bb02492e40e1b8dd9401b5c86b2176ec30a86813445152f9f29f75b5e98374e8ef4548c6e10a68c7071af2cc853e78b7416dd5d4c8b63c99

Download Submit
C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\Contents\moduleinfo.json

Filesize
1KB

MD5
9eff6d936121e82cfaf9e2bfaff02231

SHA1
34cf2952a7349a7245f4ec0b86987daa0fdad1f9

SHA256
90e61c28860942395f1dbb48a62fa5d9a6e06be3ca41373cfb69487d50f9e526

SHA512
f555fd7fa813f249523d35eb48be25b997e960d491c867f883c5e3df009893b393a0d61a3353d472c4222f777c93083828504ee4e575923437bf36162bf79d2c

Download Submit
C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\Contents\x86_64-win\SerumFX.vst3

Filesize
5.1MB

MD5
18f7f344b96c96ef623cca3c55f387b9

SHA1
584286b2c8cadf61f746f72fd9dfcd93d84892a2

SHA256
39aca82a05e8814790e923fd0af77badd6bfdd4cef1f7085d8f48b3dee18ed21

SHA512
dfc7d609daae9e19110ed9bd925cb9b6f11ad95484e16c562fce864e68028a40e24bfa78922e8872bf569ff8f3bba18d1a1753087f0544081aa487932240cf91

Download Submit
C:\Program Files\Common Files\VST3\Xfer\SerumFX.vst3\Serum.ico

Filesize
16KB

MD5
fd339f6494134dfbbd63a832bb740273

SHA1
a378c6f06093d3a899e280d7c95a188a81856971

SHA256
7c029fa4527da5f1ee584ff39c26f74776a30711678225ed2684ddb1dfc2227c

SHA512
b0ddd3134010508ae8204aeabdc3245eb1ecf3e4a0aef865722fb9c885e8f9245280259da370430f3ec1383c29968dcceec114f3181192496c6b1d7a0c8c469e

Download Submit
C:\Program Files\Common Files\VST3\Xfer\desktop.ini

Filesize
45B

MD5
219983e644a372ec539e04b7da6a1562

SHA1
ea6b6fde11fe7dbad780d1c8f8462e5751ccda9f

SHA256
0e6e526114de654c25e3759d2db54a58ae73b642a92a54dce9993a3300e42797

SHA512
f9f8a63a158096706a2731bf007ebf89013e8513529811d5519e980b344e8bbfb404c2e25d8a24e01c2874f1f1e5f711f53acf796fbbfb66016f53e81810b52c

Download Submit
C:\Program Files\Vstplugins\Xfer\Serum.ico

Filesize
16KB

MD5
94a0e05982477cc34ef1a1f3620f8ee0

SHA1
0f6210cf69b71a507cec8d7dee5238d206ffdf5a

SHA256
9bba3ffde88cf5b931e5efe69071f8c7a8714c02ae2737337a51196d67de4ba6

SHA512
7bc3cf1d7f9477064e25c7adea56ac59ccd6dd24586da6f52e40547a7f208b5cadcb315574e42c9f4d39abe050a89805e31d8f897a21c72ccc773ffa42e13d10

Download Submit
C:\Program Files\Vstplugins\Xfer\SerumFX_x64.dll

Filesize
5.0MB

MD5
49aac058724eecd7d7877808396d319c

SHA1
6c1a18ce40626db293141ccfa5f413dd233b82a6

SHA256
59e9fca23d8be4fe6cb090fb1ae038ccbb7f953c749a593c0eb214cb80df5589

SHA512
39303a8f60732614ebc7cafa556ae4ae1eb261df21f584c45ec95fa5943a0000bfff87ef2a7e9b56eb3a54b3cd6515ae12988cafa8e16744ef7091ed5a57f0c0

Download Submit
C:\Program Files\Vstplugins\Xfer\Serum_x64.dll

Filesize
7.7MB

MD5
2448edd1a85b9fac716b4811dc061cf6

SHA1
7fc5be918d39a422beb2f636e55c0c8b0798bfe0

SHA256
3236ad6a9a848c5e1b6091505398e98ba8686e2c9fbf586535bfe59d7c453f69

SHA512
727b7a2678b5e92a9696a8f3ddda486071145c496dd0d2c51b69f7bc8e14d02d2d21788d724e6c3ead9a8179214c1721c638e732eef63ef2281e54f7c61dc973

Download Submit
C:\Program Files\Vstplugins\Xfer\Serum_x64.exe

Filesize
3.7MB

MD5
69c521c8c68e7d7da15f0cafec8a3072

SHA1
a9f4ef0836c4ab6a798ede59ad3e9b6e6d5aa3da

SHA256
a86787531cb4b017f5843c93ab8ee6f9d9ba13bd29d8d9e7e8af5ff9cba993d8

SHA512
7341f6868a033ce97fc53ef0669acd78222893b3fb849a8a834072d533a1cc107a73ae49d1103e7fb16911952f193bb1f44336ff55843552fbab0e5dea0b8628

Download Submit
C:\Program Files\Xfer Records\Serum\unins000.dat

Filesize
11KB

MD5
cb887e1a9be631b6a4212021228446f9

SHA1
9f2b052a1967dc306185073f484ff660b4860770

SHA256
e44319cf1939954ecbc99f28d00298c6faf99d63ab02754a74fdd67657e903c9

SHA512
c8ae12bacdc82b15963efebcf37d492e3a184a5a21eed7d7d5346ca835f1b5538d288474dfc73888d30fc73900a7bf0ad12b7575e97d4caf9d23d459f796520c

Download Submit
C:\Program Files\Xfer Records\Serum\unins000.exe

Filesize
3.0MB

MD5
06825832c5542638ba9e2513309f6c07

SHA1
6d64dcfb22850f13f322cc0ab111b78b7292ff8a

SHA256
47a0dc31c178c2041d7c3296a1505683f5ccc524523a8635a5b2f3ca7dd4c5e1

SHA512
344816906f59e8fbdd6a73a8ca90b19e71229d54a3a1574e38f40f3f71d8a608e0823748447fa6b5f0e49d714c36d0121fa4f5a551ef4e34e31c0f8cb95bbf9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9d533e1f93a61b94eea29bf4313b0a8e

SHA1
96c1f0811d9e2fbf408e1b7186921b855fc891db

SHA256
ae95a7d192b6dfed1a8a5611850df994c63ba2038018901d59ef4dae64b74ed3

SHA512
b10de657d0cef4255e96daa1b6ad0c99c70b16c13b8e86790ea226e37e9ded1a8f8bed1e137f976d86ebc3ea9a4b5eb67ce2f5b0200025d35dc8e94c947ff3f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fccab8a2a3330ebd702a08d6cc6c1aee

SHA1
2d0ea7fa697cb1723d240ebf3c0781ce56273cf7

SHA256
fa39b46c6f11977f5a2e6f4cd495db424063320fbac26a2eae7466e82ffeb712

SHA512
5339b52bad5dff926b66044067aa3e1a6147c389a27ebd89b0f16e1267621d7ce7af9810010bee81cba7b08c77a33ede8ef4675fe049b9fb2ed510fcaef93d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
9fcdc691d8a0dd4dbb0697547fbef3e6

SHA1
1c32c959c07861d7464504bcf0208c21c63342d2

SHA256
ee749e8c9caff7cc8155ad39ff1487207913a026ea55bff98dc420edbd3c470c

SHA512
78fb4e7f821691d9b006b9811329fddb6e46676f49952e4cce28494e679777daf2a5ffbdfb670a4745c51fd85d5264ad11497138c92cf4e0e3b0a492bce3fa97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
bc1e3c8bb28dc069c214bfc195716409

SHA1
dec014d848ae28fdea6f30d73dc55ce4f08a79eb

SHA256
539308364586b9e3812fe580e39d8b1b134cf7a9fd5332dccc800d972aae6335

SHA512
300677ea5ac99bad97aae443a17d7159e087f7b1a2f29272926fc51fc1c5962669b5af561dc2765f64baed91cc1f063d44051587e87369e8b624efb3fde6797f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c87c7f2193663923148f69285eb1b4ed

SHA1
097d7edddefd0de35fafc65b5fca257e182adcc4

SHA256
c4d73c47c72b71b12d2103d6fed728c0d2667e20350fd7572e2e11ee60fb869b

SHA512
badd91ff3dba1eaa189765c7da66f03b726ba022048297f3b965b69a77b0e72ef48572f6acb62343263b3e12271d75181003ed7a35d53c8707b0aa91146ac7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a02d2310a2f047a18a9edb9da4b1c63

SHA1
8cd49ad6600cc88f3fa0d2da5086c564cb8763f1

SHA256
34a97cea27cea75a6a7a8eac8dcabac3abee1ebbacbb21f22e1aafaf3818cf51

SHA512
244977a85092d27c4cac1aa5380eeb5a43e82f49021618d4d1bff41e252f75d4d1e02556f951fa0bcbcdf1eee0d4161e19324c15a83ddd05e18f6fb9791e7240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74ac79e2e7e61c668c813deda1ee3255

SHA1
25e115ad97466d3426d6f9c0663a4f4a9d8c21d1

SHA256
b547d5560ab5828c2511c51e1df62fe389e1db5ecb8f3d788a79926feccbc63f

SHA512
036e2f78803747bd85c279298e215def5cd4c9040269b5ed58b87e7444b4fa7af5fc9231b31d93516e919d3ce6fbbd7683176be04cdb03f109424a089c3bbeb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5a84f3da7c153bc7f775b2e5b65127d7

SHA1
1efdb373f873ffe15e219fc70a5f9abfecd6e68f

SHA256
29f91c7ce1f59f6b915466288ea31afc8ea26310e6493150207ca52b0dfccba1

SHA512
2d8f5441f53de442a8f5c1f3076cbc21d92f52e14951d8b708623ea91937ec6f36785f1a3e6cd5dc3256f2ccedeeb6e5548680fe2a6e837aa33a0b401e76c186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94841f767fe78fb727335da53692ed20

SHA1
e11465609c0b6110eb53b8029832a48f127306a9

SHA256
a200c9ee23c60468a988de60e85b98a6bdcebd2b36e907a39ce5a96f5dce7808

SHA512
7e02d6711125c1e057f8d5a9ac36d7143e06bb7138b5f96a353aae9975d00baecf9cd6241e6a0774d22e707a840132073315392eaf91ee0cba29aa0e6bec36b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8040dd3e9ddf875af51b340664d4293e

SHA1
c8e40f85a1ea475525de161fe64fcc1375b8bd33

SHA256
3513533088557a4666818834d40e71d5a8d85b8cbbc93925b404245387c96b46

SHA512
5d8ecf264050a6d326d2da380f365857e6828ab3cbaceab03bff0501b9a3b8e27c3d4688553570a833c48ff125cfac2a21a1bb052d801f8e85690377003d120f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ed659b1d7a51e558246bd24f62fff931

SHA1
84685d6f04379c290e4261ff04e9e1879d54d42c

SHA256
23fafd9073812d5ff8b523b84bc981e4cb410bebbf3675db2b29cfac0dae9690

SHA512
1c3203328583241895db9fb165fcfd595f642e218ee3a453ab6873cbac10ddab693cd2f913bab15c8bb7b5a12c5768b3dfcb278aad754dec1fbffe66b81843cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ec09c7cbd7cb0b8a777b3a9e2a1892e

SHA1
3b07979e57b6c93be7d5a6cd8fa954dee91bd8dd

SHA256
a623633f34a241b0dbc9fd26f34446d716955f94e90b2ff9ac8b9df801bdae5e

SHA512
5fff0a38a3b6e4b29d402eef2650011e4d9df514e0624767c84ea31cb73cbba10c7e0b5711cb487976d637f0f60a85c431cf0db54b519411245684c116c07b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d273393955d0d8e5bacaadc826b26df

SHA1
854ab52bd4e5e7a963b71ae01ade1db62395c742

SHA256
d0b81cf90f382a28a72f2ba2bd8c16fc383709f244ed07e2a461dc3ff58f0282

SHA512
d68c7ea37949c40dac027c01c8b95b2a79dfb2f2e39800d3ea416a0634954680ee43d73f412d25698c28f78e48df1d0213914804445f2ca9e319c0ecf7bca1a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fabb.TMP

Filesize
1KB

MD5
42cd44bd7b50dc2e7e1a4d0c7ec3fc5a

SHA1
c6109f3605056b737901d086e69e225e4518e13d

SHA256
f87f382ae6186d7c7e0fa30357e05f9f06e3f3b47b56bb11a6d3c22c7d4f9747

SHA512
34faff8f39c53c0b29bbbbc1cd1f3561390bc49b601cb3b352d7820823ddc104e3d5001b6ba27ab5b891a4d3cf2e7a7f8b96d2a2f0ead5e51047e56ca6b269ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70b15379de8e0adebd0c1d46d9e130a5

SHA1
c95928a12093f46dcd56d59a2239806d3b13441c

SHA256
08b78f53847114c38850c484c9378fcddfa96c9ebf7c5c816b32d2221f641b24

SHA512
561bbb8a5fccd7f7470ce804cb38bf9bcc7231f478fb00871af600dd571028f515ce529e7cf05262a6efe4bdc075a48607fd127a066e9c22a074d8b8219e3fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
d7df2d60508de585794fccc2a98f3d25

SHA1
e1c6596c08050b6056d43326c3d77b52dba5bab4

SHA256
615369f80933fe0668e511fd3ef42950d2972317c12cc21c378b84dbaf052ba3

SHA512
1b209a01424f71f2020464f78e7838323cc9673c0edb4091ab4e60a25a199df5a511287bc261a0a79f1978d76dc87f0fbfe2e8d7c39d3c16ca4128f2e1e25a1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
bfc61857edc032c8cfee7b2ca8996348

SHA1
e51485bb23f36e75223705a15e80a86ecf7d3796

SHA256
42a45f59075852aca3fea34b265db2b2e7f820cfdafc369635e0b4db13f28d77

SHA512
7fdc891af46bf1b10ce8700cd1f232238237a8645aabf9a71399e9a224dbfb8a3cd0b0289cd9d65b9c77ea8f57f3eac4f61c2eadfccaef940091c9882076420e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mfuo34j5.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
a39a5ddbadee630e079788f8f951f4f5

SHA1
3a424977663a0792aafe3115c19d81167f79a1c9

SHA256
cdd8a1f4bc21f32c8d5b189653e1c0a656468d8d4e9519dd33be4a8e32ee626d

SHA512
3fd88bed37e47d7a31216bad90eb2fe79244a9d6d4429ad1691a5b1762afd55c5b7054c7017b42f82ec70423d376e390609558746426ed59d0d258dcbee4624b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mfuo34j5.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
08a9139cb35d4e6b9359356da5d5f65c

SHA1
3f9fe7c7c0fbbdef105fd88691b6b1100abfe806

SHA256
8ffe2191aebe01893471492e986baf4fe887445a9db9a860aac7fdd2e51fa612

SHA512
deec8b91174af80e2654448012b10f2640fd3cda2a643fc8d1cb78bae6abb3d3d6656dd8d7fa32b3cb570355bbf6095155937480ac7bb8e944cbff55f123abcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-17E52.tmp\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.tmp

Filesize
3.0MB

MD5
ede7579ea135a0b8caaeaebcd76ff500

SHA1
99eb17f3c7b96275e44472046ec2cd6a48c9d677

SHA256
5eea98260d9712ae1adce8c2d4fe394a36f0a22611f6f0f85d158db5d1f46513

SHA512
1c2dd5d70fd0a46ac3de68b6e3201f70501056c1bd8301ab6b0d2a56dabdc782ac5aaf4aba354c771cb81c137c1b3a41021c9bfc90873fe52a528765f378c17d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
857a16c580fd5c7462b0740d79ef641b

SHA1
a1fbadca588b07878e8432d91f478ab95a8cda71

SHA256
8834d1624e70c54cd6dcbb6cbfabb53569d17f4c1ba9890c28cb618e19e9783b

SHA512
edb89bf4a37c5f1f4e290501b03981ca76a5ab080cdc39d2c76e61e3e4abcf25ca88594a263851e16fa907742a43a9582b1d405ec3059d5a24c559124cc71106

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
7270ebb2fbffa90d4c842b0067a40be0

SHA1
e340596f318f01e561bdb395fa047f68c9f77ae0

SHA256
5d027267092c9f3de6523df1f6b46e886112cb6bf69d2637385fd42b3b0fae9e

SHA512
6d147641fbcb32cf018b836fc84249157e64b4c760555dddec430c89ce97b9a5f9760c84483af1aa3f604a345581060b368d19c6d1a1b4210c593668382b82a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
e4c9bf9f3ef173691cb145fe12a4ff05

SHA1
bd1049b10d150a1e38580d6e3056e69b3bc8bf67

SHA256
47a8f0b4fe234b805e4dfc0d88c30f6120fac074a8648123ed1848ccb3b0f6f5

SHA512
318970d61dfb96d6611f3d6ddfbc5d0c985ce7f2c39a49d879de2ef1c7843cba65e46b225093e4e4993a8b4357645628fbc4fb3fd287a22f00789fd13d124ae0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
28456849643b1a369eaedaf44d094226

SHA1
f368a52be3cd7fa174efd94b256d26be6748f79c

SHA256
25b30f846c82fdab75d2e8c273430874012e4f598c07a22f26a051371da2474c

SHA512
c2dd6cedb80b1c70e82bc1c544614e1af02177c42e4abbf1dd9a45b65e9a9d43af10fe34973245d32c72f1f79ce6afbaca12024bd9b5d749488964b5cdad4710

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
734eb075976dc725f3eefdcf3cc36e69

SHA1
15da97545a579f87763607801c9f8ded43357bd8

SHA256
785dfa09b0c0dd762a9a8fe46c91b6ae21bbb4ae0c221aa66083034824f25732

SHA512
f6c859f686c93a29fe35d0d99beeca1129f16d55e9c550eb7a10bbe8841d28343db09cc9dde934134e0f8c76be5c5b51bb1b5c2b1adef385ce92b1a543d98550

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\AlternateServices.bin

Filesize
8KB

MD5
9506ec2466057201bddb28f10d170809

SHA1
c50bb0cb3374af16daa23bac44ab92d4e4db61ef

SHA256
9b52c80f9cbfc65b5d7138cf197576e85e96b613eb6897eb2134c19028a0ffca

SHA512
751aba848366db0ec3b3b1082c6aac1fdccb6f6690febe18b0318dfe7c1c010643ef3a8ad1aa48e1e275d16559f1b8e4657346642892591f8daf9f53d819158e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\AlternateServices.bin

Filesize
15KB

MD5
fde264ce58016031f732cd4e472b19fb

SHA1
f2b0ffc2e58569e7446792d43779cc0f4f2fbff9

SHA256
fe174c70b581a77263db679f52ccab003f5cfeb4f6899e034478ef2418e65ae2

SHA512
d87abc5a0820ee895fc697ec96f78796d26a79913242726885d96d889c0cac99b145b6b82a8d18659cc6111afa4a1487caba9a5cfa5e1b56ab288a6515465c4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\AlternateServices.bin

Filesize
17KB

MD5
10f8c73c384a440b301dc1fcfe0468dd

SHA1
25f27f5a4243f622ba944f26f9251ad9df93c372

SHA256
0fcd19d444c45762bfbf25c856eac3ffa71d3e0893165f8568cac9c92c906026

SHA512
4d18ea7638f594d85b9717d265d4ca346634b3d7f1794d17601834e34c14ed267d0efc9676f4191d8a8c221dd5b7a3e70ea6d7d75098c62aea29a2db8a914656

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
98e5d01aea173a22840141a118700345

SHA1
7783dc068ba4c73317ae7111f3afd2116df6004f

SHA256
e94746fba8869921f7a103e04bd5d0bd1c14921f3ab8c4de68b32e28495de011

SHA512
27ad5baac1ebfe3b6f871f53607de98502f7abba2eaa2180e9d9f02f5886a39bff573d83ea669037feab062158f3cd258c1a04e2aa4f208f4d013488901bdd6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
092d5865e528682bb9ac2916b5a8cf55

SHA1
1abfb5fac5f12eca72bdbbc8f3e228efe1b7289e

SHA256
a62a34ca9d72ac1abaad83fde51018ccc47d53df0a1ff05146cbf4c4a88b2cbc

SHA512
c63c639073c7984063386075af83260e478298b2f677176f29be3ce6cd73a5eae7ed18c92687b775bac4498c9f16a21c19436c85a14b0f004a40dbc217603c1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
5abf90bbc85a22fc4879e048686eab32

SHA1
6efa4f87770807569faa9006b146ade0c2e96169

SHA256
67acb626d69b9aa961ef9970409f2e50aab93222c7d4848b260e73975d8d14c2

SHA512
677ce0afd40fa6bfc4f1ba3fba2714b7990aa7b1ccf2602f4430e578556dace7ca69ef62c342bee559c4fadddbb5c988e14c1c2945db42658937525d45af0f86

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
33246fa1f3eb38acd777d0ddde7508b4

SHA1
0af9a5c493e4e6f6666d2e823e2ebd663992d183

SHA256
f5d4ef53502f5cf1fb75499d3ef691a99599847d84ebd15a58b4168e575db05f

SHA512
ac93227d90784ba258dcaad8645a3a4180095d1322e8e60e72cf7c627f0c3d6cc47bebade98f6d05f4f69c2c17e9309f40349c0fc30b90c9c75784e344301f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
51KB

MD5
5f4b82b8e3bf379b0f76cf3975ddb3d5

SHA1
ba336fc2197e68a0797ba6b7cf0096ecdc52eb66

SHA256
75efe83c5e1a6da92dfae616bd51042074b51b8053a0a379432e72e1848f9ea1

SHA512
e87ffb2ca69bf015ea8ff4c15c2ba70e10a007824df29365e1e175589335f1019cc6f486c7637e350c23a36b17bea4db9a50e53fe706d3a7cbdc195227e590e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\pending_pings\51b54ecb-2910-4433-b721-3d990af1879f

Filesize
982B

MD5
fcd980c0481ed8a4077af4ef2441c5bb

SHA1
a93ec26bec439aba7d42a94d51eb89d85dc01595

SHA256
013b733baa766b2a9d3961b04d9f7b22e6f11198a01a2a533b7756905f5f24fe

SHA512
566c83abf27a490640ef81e13ba947fd41cf389f054fe211201ea6cce00370362a147ce52d2008d14aecc15c49c6b2c5720a7051e60ab93da7755fabb280cded

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\pending_pings\a222b67a-9911-41f9-8f9e-13127381844e

Filesize
671B

MD5
83b9ec910f822e0641460b1d7b69d2b8

SHA1
bf6a4d5d328afd3b711900d9ba4e75bd9c5e5991

SHA256
067901b6867b44970468b1626f7946323c01e5645d44d9ff3647a58dcc9807fe

SHA512
036db57f09bc97a7fe87dc9f9aee61fb1db0b4341e913b331cdd75093993173925cde3b298c389dc2589af2d39600aba608516d58c75729b2b6751260bb9742b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\datareporting\glean\pending_pings\c21cd0c0-c09c-4ace-b374-29ea0c498c3a

Filesize
27KB

MD5
614222e26321c41d73c316b77f8b2760

SHA1
46f16744fdcaada939c2ec5af45d814313f5f5c3

SHA256
e2f436ba68c227c9cb5525a8e94d5a41d2eeaca0f99df66329178e1e99bf97f3

SHA512
dda1ce5e05cde01af2446ef3ee0fd11dea2d49ee9cef3ffde20bb43b5aa730cbddf1f360c07231cf22cc8226248d0db21ea5efc5a7941c32d3af11fe905d86df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\prefs-1.js

Filesize
11KB

MD5
7a94c179a86c0062c2121fd159365b14

SHA1
80eed89d0f0fba76c2c6b54ed16acb9b192567e5

SHA256
edbbe1128eaee19d1f517ba52c1635d5f247d13fcc37146e533ca60192fac105

SHA512
57ffcbb27c5f5122278418af8a1d580b8ded4f2018be7e16e660accba6d699a3ff308f88809e737375bcc274034d95b024df0e58a9d612e68e8ca5dbc445f8c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\prefs-1.js

Filesize
10KB

MD5
a92f2626a62f7790b3719ab7ed894c5e

SHA1
c575867f1bd85d1c72b22a2517a2bd99a25cd60c

SHA256
6034e1a12c1318f6f553cbe3521c391c97a0e95e8d4f229cf54777403a77bc19

SHA512
8f1f2a527390c1d3f8fe18f4fbf3e6cf83b63259d386afb2ac9eb908c8ce0a208201c0bf34f918e79b929170ca49b179c4b85c620aae7f85c4158dc57f08e5ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\prefs.js

Filesize
10KB

MD5
fa7e97a15d3f8af2557c51a561245083

SHA1
bb93cd90b29e65d66b99058015e85b7980e418c5

SHA256
2ea8283740696a39dc28f9f269880c8e65715becdb8238d1f3f14c49fb215f84

SHA512
05171836ffcd79931d4a01da9f4c9564d2fffcc2d6c3372a54bd59b4f3169397130417a938c98ba5bb970ada7906812a05f23eceaf0af9f76c00571ae0927f94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
71a51af521761bd39ff9d354c7fc78c1

SHA1
4ad7675caa2aedf7f8c3938d42ad656675e3a5ff

SHA256
1d47a9cbc1c5be8d5f5b052cf2cf799e3a92f0abffaba53f985f595026516a36

SHA512
453da51a53e29eded34d732785227edff9947093a731782cdf923ca64854f3a727a54894c965770a5567d5ba7d72730fb6e538fb6fc81863bba084b34f41d750

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
f9805f26c0927ed1af9c3052bbd56ad2

SHA1
71d27f0881022702bb0a4a24e8b6f27bf48578a7

SHA256
02e467f1c88ed16a76721d9a52fa5ae804b773cb6e9cb79779d0933a6e30cc15

SHA512
020297b22cc73610eb366f828dc1787c78b95a7b33866913765b82abade5ce8835b3f381c082326f3a22b03f810b0e28f4fec33500bf2a2ccb2da33e569cd678

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
a6d458728f629d142a45a3dda075907f

SHA1
9ec87357b274fcf7e09f0ca67a19b59fcd007ce9

SHA256
da8b26a9768c53e1a7c318885d083e632077420e69530730d9565701619ee2c9

SHA512
24fd6cd99af13553657521ec96b8bd269a64f0db976d6c76233d0ba0dc7320dfb41c067ca0ffb547a66a58608fbf7926eb079151f051f995f1b6ac72a5d1ac52

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
47e1fcc7c47dfb1531b5ef1a8dd984d0

SHA1
80228ede0f64fc919a0954be8fb06cf41995980a

SHA256
f7a35c3d5f0c326f18c8d4a651cf73799ee6ebaaabc164e4527cd1c100b2d48a

SHA512
d9b05b5b2e967335536d363cf62b9a2d8157b3a6656dc8f39163e3eaa1a29079269c0ec71c04eb075e91ca5073f4b88f25aec84bedb68ff1271a9528110f8780

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
b476fb3235fdba9fd294a9cb0a2cfe46

SHA1
20bed74505da479aa55eee8b16c1c0387cdf7d38

SHA256
3e5ab173a6304aede163c2ddb760d19b95df6a74bcdfe5f88ffa00eb08f18575

SHA512
b096097af37abce0caedf7206587d8b4c4c7c244e6b174946f6685a0b41fec0f8be2736938a50b4ac5aadf18ac32b5f539f4a6a563cf7cfbc13c6d7dc9c57b09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
a9157e3b4d521a391b5bb85af5992f30

SHA1
6f87f24dced6bff6a25d5c91fd5aa6eb792bae90

SHA256
7e5d3da172e41bcf6e76275eaaa736d9a5979c9ffa007d9761f238256ecee99f

SHA512
9e970c5d629f9a25a47523c75f42aa34722f09ed721651f2438571e22f96898f415eb18f00fd695e2ee17cbc20966b8aabd94263414609535dbb7f3566941da7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
598ba82b2cbe91427b19dff156e551f7

SHA1
ad7a886a28150fed34f2f771861920a66d9ad29e

SHA256
f981d88fb924ca88b2c834896693cf1008d167c7dea8516735bc2ad8bf1a1243

SHA512
ce48e5fd482983f64094cc2637bbfd4dfd7436145e0553b092e0f78602813feb42d5d4e1b7bdcfcd522af62d4c68f8c64710de0b3e4b7ea7b5c65b7282bb6697

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
5c9f51c324b82a77f33340a54eb06a47

SHA1
cf3405893ff5251b6215852acd90e8c620bf5d31

SHA256
7b023442c197e2bf5e9c94ee018cb53edcd21aa1f7e6ed1cfd40bb2299044809

SHA512
1c993a54663614f98790e9598ed63e9223d6ad14c9b16ce0fb8f269796d1890b2458eaca1dce133bb951eb55a0dc08482e57a4731a9d0d968190fe6518ff92f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
009f333cd986dfe5f8ed3366b6699ac9

SHA1
72eb54f809b3cb6f02fa6536503c1975d049fe21

SHA256
215d01f3d66e3f7e54584014258876f9e547a059947e4911134cda260f6415eb

SHA512
bf1c66ec0c48b9988ff8bfd8559c28e29e93bbe05a2091c062b4e887be3928eccca45fe5680617e9cb4d50beb15ce77035b321fab0b391d045c948d3e0f60931

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
b4f4ee00f38d29a7d5990478c575bed8

SHA1
76ac321ba0cb7ee9acd8cb9f8a88dbf34e4e6ce8

SHA256
9bfcc5adfa23308eed046b9cef5139a356bcb9f788d74d2fdcae358077134ca1

SHA512
d0d2aacd5892b198a04efc8b8bdba932742211cb15d9834ac44ca44d1745277cc6d8d7644c743e7900f196b76214f8ceaebfa9c1fc7e4964d1087c37a7766083

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
44d022c8896981f1881bd5e4fa670071

SHA1
d2ea92eb0683689ae99bce04b685905f92b08ae0

SHA256
2d3c38d259afad260ac0f49b3ab1cacbadeb5b449783429bdcd46eb8e108333d

SHA512
25b479e56cce4a5a280ac6206d5598a5ac45affbe59a09c405edde7b5467707758078c9d8f7ddf0748645a32bc5dc11f3d8f62b835bc494480290d810fb5c715

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
28b0769a835d54372ed75755d3822b48

SHA1
5d48247bf0c4fe3f23433f67d47f022d2e8e7baa

SHA256
246dd871ff558b9cc8543bd1147d1d890044e00dcf7bf177f5dc4c1349c48357

SHA512
d16e320fce94b8f06ef7515b8b4a6c8c4de971785bed1638dffd2145b98a85bfe112e66a4bc10bb23b1d36ff03943559c00740cb6bc3c4b542732a1de2f5ab46

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\15\{169c7ca6-c6f1-4ae1-b1c4-23e018151e0f}.final

Filesize
496B

MD5
a60533e1a43b07c7b6b5d026896fa7d4

SHA1
a9eff8cfba426a21a39f4fc2f1078bb6e41a915c

SHA256
c2be993a36460471113c9c1c60b146f08591b34a033e62cde1f4a97eff18c639

SHA512
66fa58027edc3f8b371d80e8a4cea629bb81837c6437e756266418f900e897e052cef7eca4ea8ed87b71c79695c427914c8a3ce99226eecb24da435fe4078279

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\160\{b39b3bcf-dbfe-42ea-b6f7-d2e612d073a0}.final

Filesize
31KB

MD5
4bfe8e77bd1310f663096697db87ae6a

SHA1
46b2e8c8ae0d646535a4dea56070913cf354ef2f

SHA256
85dd75f0fdea3b8a116f833fd7a44f24844fbbcddb01f444d445e3461d46ba88

SHA512
3bdbd35512cf5fbf1856a3ba21fe2dbea03ea36480ff5c6efc35eaad703319daf271ff4c81198a1796e7f96f2a058a9c7d79187f88322b6a9ccb2557f5e212af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\226\{3bf01169-9402-4547-a3d9-56e6c0e635e2}.final

Filesize
889B

MD5
a7da4cb90c13baf8d8e9eb051ccea9e0

SHA1
6120025c6820a5a74ff71966e521bbfa66c8f5dd

SHA256
8b362cb4f00aac3423dc90d28871105d2436600b0ff8ad8309ff9296a826e692

SHA512
962f166a9658623a4dae5fc2d52b0c40472a3648b37d62629c96150fef28fa4f02ebdd7ea62529da9715d054f2f1f6eac9194bb0b501c2500595c2287cf8d8ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\229\{0d4fe698-f5d9-4347-b9d5-9c8f5ef424e5}.final

Filesize
231B

MD5
6de7aa303cf9221ae762ea40bdd4c2a3

SHA1
4d78038733358dadfc4d99a4e06547fef2480c12

SHA256
fa7935dbd66301c7c780ae92563943fdbdb04ee0b1a1641f30c008bfdb174f85

SHA512
468a77dfcbf8ee2257b1dbf8246977de7405631fc821579cb1c30b68e2f19bd8eac77ba4a2c3900e64e16cb10253781caa0346b972b547d495295563662ecfd8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\231\{b294dacc-27c1-4d94-beab-639f9afab8e7}.final

Filesize
914B

MD5
42be2d91dc1832eaf1260fa229a36e5e

SHA1
8a9705fbc8e6b1d239e4830b985b446e8ba82824

SHA256
586ec9b20c107b3bc831af9a3999e6b040b13c0c140ac10dcbb150fe7e724c11

SHA512
ac5ba80bf723afc86efb632959236de0563bfc5425bdec4cc0039e38aa8c50848159577b1d7229da82d726cd93d069dd12e47c41378ecd5e51cbca2808b4e808

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\46\{dd444806-90b0-4000-a66f-77dccc20312e}.final

Filesize
1KB

MD5
405b669e8079d96f7bcc412bc1c2e9b8

SHA1
708cbb4f6beee3f4d5f0d371b081c5c251601fdb

SHA256
19c8781adef7b3758fc70b15072ad164095d8b7bc6f30de8e5919283b83d140f

SHA512
4dfbda91b86fe59b77bbfe1ae4d193b6677d1d6c9bd25f691da0c05b60c25d1d0d2aceee347c3324afff7e7071f2810f74742752407fbc04a0cf247c359815ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\56\{b8b32855-5858-4da2-baea-2802400a0a38}.final

Filesize
463B

MD5
7004f20cae1adb3acfd6a2e66a249d67

SHA1
74f91d638a7a974894bb0502d62638f56b2e57b9

SHA256
8f503fb7cf36105221e29684674f9da176ae85019b82e889e70ca3f181803af8

SHA512
1b10acea9bc2ab27bc9644410439136b56af3a307b7b5f1335039b54603a78b4261685b14fee86b4572a0067c5b13218f0c6eeec9febdaf6c349db31447d9bf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\62\{3209aa46-2cb4-4cbc-aa40-59f0b8c9193e}.final

Filesize
428B

MD5
bd0fb6c22ff19f80048e77c6eef33bf3

SHA1
bd9c8294f218dd922054d89698d189d377a9df3b

SHA256
54e87ae167f0372aab65ac65d6c69328bfc5e8ff440b3855852323b9e83d8b93

SHA512
c35d77cbe3b5408b6c68d782e0f78bdce1c4b801bff7156f67a1589e8573a8da9582f8c20351c105595d3d46a116c72e9acb2bbf8ab805c33120ab6d0ba95ad0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mfuo34j5.default-release\storage\default\https+++send.vis.ee\cache\morgue\74\{c65fd5ef-64db-4fcb-b192-35ebb34cf44a}.final

Filesize
1KB

MD5
1ca3cf57769dcc70bc5b5bec5f472f2d

SHA1
dcad2370499395ff807e5f2bbfab69d7255b0099

SHA256
82f8ccbabf81006933f2b4a212dc45521bf512ae513ffa04140a776753f52be4

SHA512
6d016cfe9586dc6926c6d93b704949b6e12bb9ecf1b09da83e085cfc4661577b718376fb8771bbf5c5df4c75aca0fc8df55f7314e45efd33e6b95e5e00a9ca2e

Download Submit
C:\Users\Admin\AppData\Roaming\Xfer\Serum\SerumPrefs.json

Filesize
1KB

MD5
c23d4d0b9313f65db17068251b8b5f4f

SHA1
9b573fb514cf3cf2ff6e6c72db27fa6ae25068f6

SHA256
758a2372fc2478eae24dd03f50e239569fcf79ec5e1194953566f71195312fd9

SHA512
6645d52df06c29062beaec0db80502414dc2596e4d6cffe822e5e056a33eae5eae64ee5490af1d7dfcd5e7e41dd088f1605781c2e7dfe8d41a1b151ccfab3e2a

Download Submit
C:\Users\Admin\AppData\Roaming\Xfer\Serum\tcd.tcd

Filesize
7B

MD5
0afb70376a0de720ffe0d8b316f12252

SHA1
87d60dbeb9afea928808d0de67eb06febb2f43a6

SHA256
29935302fc4f312900cc7a90d318003dbcd9ee02c6a7eafd2a9028c726257ac1

SHA512
16d6767295b1f81b0c59729e647c3a5d6bfb066de6db66f75d4a8008cccbf865d3f23404a1511ca7a3e92a4f8fd1987ec78616e2fab879c150e7468699092c75

Download Submit
C:\Users\Admin\Desktop\Xfer Records Serum v1.368 WIN-TCD\Xfer.Records.Serum.MERRY.CHRISTMAS.&.HAPPY.NEW.YEAR.v1.368-TCD.nfo

Filesize
1KB

MD5
6af4f88baa5aed06a4fb54230689b0c0

SHA1
4fddc86e13d968e7b8568e660d41cfbc2d7b314b

SHA256
7923abadc8104238c48c5142c8c222e057f801f9de997c2a3721ee05647d02b2

SHA512
5698fa98d7b80e6e0b254a2016e41b093a90113d9c1fa76d5749941c69fa796c4d5d8127a46366b6e4744675435af604655836763fdef42228fc141dd604d742

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 297287.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
memory/1484-741-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1484-748-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/1484-848-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/2524-749-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/2524-847-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/2524-836-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/2524-755-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/2524-751-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/3468-907-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/3468-867-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/3468-966-0x0000000000400000-0x000000000070A000-memory.dmp

Filesize
3.0MB

Download
memory/5312-860-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/5312-866-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/5312-967-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download