hxxps://doublesheeps-china[.]com/?uoaeholm

Resubmissions

28-11-2024 01:34

241128-by58asvrgl 5

28-11-2024 01:26

241128-btj49svqcl 5

28-11-2024 00:30

241128-atfleatlbr 5

Analysis

max time kernel
139s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://doublesheeps-china.com/?uoaeholm

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133772313001245909"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
2300	msedge.exe
2300	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
4512	chrome.exe
4512	chrome.exe
7260	msedge.exe
7260	msedge.exe
7260	msedge.exe
7260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeDebugPrivilege	2152	firefox.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe
2152	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1148	2300	msedge.exe	83
PID 2300 wrote to memory of 1148	2300	msedge.exe	83
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 1300	2300	msedge.exe	84
PID 2300 wrote to memory of 3228	2300	msedge.exe	85
PID 2300 wrote to memory of 3228	2300	msedge.exe	85
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86
PID 2300 wrote to memory of 60	2300	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://doublesheeps-china.com/?uoaeholm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe67d946f8,0x7ffe67d94708,0x7ffe67d94718
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-databases --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,12931217905575271596,13598336982572801990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe54a2cc40,0x7ffe54a2cc4c,0x7ffe54a2cc58
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:5168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3340,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4140,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3276,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4880,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4900,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5116,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4148,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5092,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5108,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5544,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5588 /prefetch:2
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5520,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3796,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5752,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3528,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6048,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5844,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6112,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=3552,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4612,i,9117962453311075958,51119164234122749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:4440

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5668

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5876
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e559ed2-52c9-4ba0-b38b-a7d6676a67a6} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" gpu
    3⤵
    PID:5412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e7ba430-8cb5-491e-961b-d022aec02248} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" socket
    3⤵
    PID:5988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 1640 -prefMapHandle 3256 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c00afff9-730d-411b-bd0e-a0776e084285} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:32
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4244 -childID 2 -isForBrowser -prefsHandle 4236 -prefMapHandle 4232 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37c7132e-2246-4788-9453-906d57d0a691} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:3936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4776 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4788 -prefsLen 33104 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e75e24f-25dc-457f-b451-5cd1dfeb73f6} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" utility
    3⤵
    - Checks processor information in registry
    PID:6820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5288 -childID 3 -isForBrowser -prefsHandle 3876 -prefMapHandle 5220 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c52e091-ed4d-49c8-8a41-b65945329272} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:6200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 4 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {773b8fe6-f6c9-4447-974d-30e36d090d1d} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:6188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a4ac275-44a5-4fcc-8be2-e7adf78c7677} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:6176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 6 -isForBrowser -prefsHandle 5964 -prefMapHandle 5960 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9b6ac02-682b-4a9c-8182-7e61e9d1cb76} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:6984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6096 -childID 7 -isForBrowser -prefsHandle 6104 -prefMapHandle 6108 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59498c7f-3551-4d1e-84f6-9cd50d522442} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:7000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6396 -childID 8 -isForBrowser -prefsHandle 6408 -prefMapHandle 5960 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4622534-34d0-4bdb-8cb0-c7e18d81678f} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:1980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6740 -childID 9 -isForBrowser -prefsHandle 6736 -prefMapHandle 6648 -prefsLen 27307 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57320cee-6184-4d58-99a6-38600840672c} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6648 -childID 10 -isForBrowser -prefsHandle 7052 -prefMapHandle 6748 -prefsLen 27355 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57b5304c-9df0-4de3-a8ae-333176b3024e} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:6680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6756 -childID 11 -isForBrowser -prefsHandle 7040 -prefMapHandle 7048 -prefsLen 27355 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a6538ac-a196-4958-ab8e-6c004e3e7160} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:6692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2736 -childID 12 -isForBrowser -prefsHandle 4440 -prefMapHandle 4436 -prefsLen 27355 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fed8276d-e124-4f2a-b401-af01867ac90b} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:3244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7064 -childID 13 -isForBrowser -prefsHandle 7480 -prefMapHandle 7072 -prefsLen 27355 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26d62d6d-fa48-48fd-bac2-86f64e31d8b7} 2152 "\\.\pipe\gecko-crash-server-pipe.2152" tab
    3⤵
    PID:7184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f7a511b72ef31799ed56dac5ccecc297

SHA1
e86397a39d71a9385f7c6bbeb0d6b72cc25f96b2

SHA256
2add8ee3571d1e85f9eea66820bff7178a2d7439b8636965cf33d7933f065a9d

SHA512
39d015bbd086fa4553f2a6a4e95f5202a9cd930adc209002aeabf46cb2baf24b3ca357181b4d2a7fd84daf1cb7a664c0f1a6352e6fc85ddf4aabb0a9a626cc1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
5490ad8c201a3c3cffa2247d954b533b

SHA1
a5b689a39d4e68c5901b3087651f468722044f91

SHA256
49e05ebb376e74ad4d43342046188f292ebff91c5f64586e1b606bdb4a37cc01

SHA512
30133d02140c64aed0e19d07c492c04dc604e7e38317683ff769862ebc943d644b156b019c88861a27e41164114b58297cf39df87dc634b96a209e9955e06a59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_US\messages.json

Filesize
1KB

MD5
578215fbb8c12cb7e6cd73fbd16ec994

SHA1
9471d71fa6d82ce1863b74e24237ad4fd9477187

SHA256
102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1

SHA512
e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\manifest.json

Filesize
2KB

MD5
236d2dd305d64c2b6abd232ed53270df

SHA1
9f6885e95fbc4213631f0b0ea49c803d07d34136

SHA256
2a4d526b9d1c8665427fb9e0da58d16fdde382dd74c1258941b18701ef7880c3

SHA512
b76af22153f79bca2429a23746a62a430a521e952e7f94936648ecfd25afdd9801acbf6fd16941918a4fede39de747ab6c6336bc86ca74384920af7e815db855

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
160KB

MD5
621c8a7a65568feb72a5b9c9f397c904

SHA1
68a485ae845df95c02c7e51962e1bd2928e258e8

SHA256
3b4b9c19c93dd163863c938e69c016d58e3b19ad291037c93195684c8489cc27

SHA512
8345fcaf8eb98fd9d965705607f2abd07cd7db8d43a50a5449cd67af2428ec86bb07034bdc73c1f9749f31bc24a627602b196454f79e618ba5fc1c8cfca8512b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
0c963867b4531ec2e4b394d6398934aa

SHA1
ccfb8902e8775ea83ee80c0036772dfb5b59ae35

SHA256
e019348dc0a503ea328f793fb0d31df538529915f1c415adb2089fc050341600

SHA512
cf244fdedca616df75dad71dcecf60f37b39012ae0cd085aa919ce64587940c19806d5616fa5bfb7441227ce669427cb6383ab08e07c6041476d019e3ac2993f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
859B

MD5
746893cff066a6a10b83eaa85adc6a6d

SHA1
9f4d46df0396b4b0de5d43da130599c771bf14a0

SHA256
2df772adc318ee294e419ce0822490a19c055296916613d740a4a6c5ac76d938

SHA512
45995a235f81b516760afb8f3ae79568e3624d969ac018b17fa408345dc54ab73b5444b4d1ce085a1fdd21f013ef55fa82058ed40a26503328ad2fad4e4cd105

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
39c77b51865bba745a7ba7cf8500391a

SHA1
2bbab3dd5a6eb5505bd8edc734adb44cb45be90e

SHA256
4f69b5964f4671ca423e5ae03cd88331142ad963bf9fc7710734a8534c5f5e7a

SHA512
2fc0713f2bda7f909ae5f3941617c0cb6febf5e1c877317061b3f308ee0883f721b4acf46fbd2aa7d5dab4bec9947533e763e1ad7f1f6c2659adb32394e2264e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d69a0cfc320330d26ea2ad851af4ed0f

SHA1
81878889b45aa8c02b15560951cc77a2c4337f1f

SHA256
8fa299ef555afc20e1e44d296a6bf08f9faa0c6f86ad5d744abdd48ee5f1de76

SHA512
64ef99dcc8a6f3fdf629fb2192952932b98f9e293fa5e27057946e1484fb8a4795cb328fab4e849f28e719d249883b6d490cc79943e23fa3c52b69ab9ed57cac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
73cde6a5b3b592bc1dfb22f29715f01d

SHA1
65f3096270ad03e6f5d08d42ebb0237a8da9c157

SHA256
1f3bdfea0a360f10ddaa1ca6c58bf33a3184db4086f3981ac52599a7d1085af1

SHA512
79bb96ba0380fb83c1b4677577ef3036b7b6849511640e6a21c4cff1d7681f565a89bcfb3295c2b959f1a4c44230a88f5b60b477a5fcda2206d84e3a91a2406e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
34d8e9af7acb8fae5929bb7fda4e347e

SHA1
4b467cda9778bab3da45b3cd7a9ef525c180efdb

SHA256
170d8fa7b763daf96d7383884e7f36ee74960a8537d4cdc30a519344bfe99e6e

SHA512
01aa323a2bd6fa59d2b148dfa95f15d8ea228b987579033f50c40eed54e9a717e0741bf354b0ff1d18088fffac53c755268bfcf879720729b7e3217befdcd201

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
629564ea2fee847a36bc611e92a28398

SHA1
2ecf011bcfa007bd68cd6c135ed6ef80da4dbd4f

SHA256
e63b08fea3f1b1b144b9b1f01942201158c4eacc7372e4e772dc7496ffdeb9e0

SHA512
5c142db722d7df2db0ed797f65a099ea018290195f772e021bf6d6fcf7080c064bea5e9efdc3da5d50677e1b7503c8253a74c0ebd6cdfde7f1fffc9b12c5c91e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d06dfe04c908af6f302674b7b171e01e

SHA1
80bb76f9d00a3be2c1212eee42a44d2316d94520

SHA256
1c6ccfd05be47bd7ecd5d97cad59e2724f4a66c133b2e94374d26b77b20cfb7f

SHA512
0aab50b9e29df509de6025bfa6f726b203aa74b879b27cde91f63e86e3e9ff70ed069b74ec1b49fad9a9e77ea950e4e200a0822462a24a22e31c6b23464b8aab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f5f2d6cc2c33521cb4bcb45258ad0629

SHA1
dcd57ebd243dde0eec1a17aa1b7f02623f78b332

SHA256
ef6874ad0891199d304911cfe359ffc88849ff516c5b6e1e4443fe7c5b9bc76b

SHA512
3138fdd329a71860f8c31e174f14ed208202efd36f91e40a66c800d61008b800cf55ed616ed69be383ebd99f32f02b3c95bd46bdac6cf87d7f29e0eb0923837a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4e8fe425629eec4d083e3a3864164edb

SHA1
8da3f31bf32a0e4c20b529c50438d35b55c04a60

SHA256
e9658a6e638bbdc8747b68d638bbf1d799752a12f8cac0521d753b51d5abc9be

SHA512
100f33a6327c4de9ac56212f11b54101191b800b5f52e2b9377c1612b6d294ae295b5757a13078fe58debb0e4c91204f5f5d7abe319efa0f848187c6872f1a63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
80a86f54b20a04bffce74308ff10dac1

SHA1
c0f9054cfbf01075dd88415df2363a10a983823a

SHA256
fb9573d2b350c4cc3b44787c02e3e84205a4e6ea9d9f372cc09d46b71c31b6c4

SHA512
4a66da323e42079c05280f834edddc96b822ad5e124e306ebefaf1b0c450d039eb71846e96b6cd7acda30d45b7096a822395748a5ea01e9660c4006449786ddb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
ef02e3093b1380ecb006c7fae768e356

SHA1
50833c5cc28afde03c39a239665974f913be996f

SHA256
616f7c13514b68ba737f859001068449e7351d514c5fc957726bcc21c8b1ebb6

SHA512
661be88b42abcf73baf4194d887c1d3184a6f256ac3d9f928a9716419a28532b33b07d003d199023437c3ce0026b0e75e27ddc12c963aab0d0da32844b7b8b57

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
28062a63eb06aae306420ae653c34b7f

SHA1
4521c9eaac41896d32a7eba4cc0ff035aae87694

SHA256
90efff62d0e1ab7938a941201ebf35493394dc4d89f25b6bcafa7cd30f54ce37

SHA512
ed28ebe687c16cb8786bfd0967c8a83071364f42f9127e0de8dbf2c5874469726600ba9b6edaf0699bea255713cfe9c6168b1065fa2e41c0c07fbb59a262974e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4c398ea64466bf248e4528912b635e6a

SHA1
8fb2f5ce09fa8562c62db7e937330d6be4fa4a79

SHA256
198750fdecdfb860b60a931a268272ac512608645e825fe99af96be0bd94e11b

SHA512
2a298a645cd8d7f1bf4bac58749cb9201dd820f11788272a3c91dfcf159af5803bc347f6b63227dd39f50e78ba74f310d12ee927de32048548c41abc29510547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
2a36982ff835f653fe372166ec4ca1f2

SHA1
65cab1a296c84bef968df7ec44dc96b9b1b68e3c

SHA256
9feef3b2b81b59fc6d6e528f5c62968b6c7991502a36e117f251dc6d33a135f0

SHA512
0290ccc4135d12d8121cccdc5ad05e545bbc81e707afe4a3b31b00cb4437c4c2b5ddb102622514fc6e4e1aa2d42b2c8694f15925e2afff3d681dca23b6a5b530

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
352B

MD5
96de3d07d0d9de21f4dfc8d3f32d0e60

SHA1
6f072eb62abae72f0da188de687a9e98a34f480b

SHA256
0c9c86a395418939709aa42698406c488eea3bf2a3a0a019519506b60d1d6a5e

SHA512
0f2c27ed817158e6db17a99d567f9c5fafc64ac69c6cbea0586202793f3a6e6eb55a9baaba07b49c8fef6477e0a92271cff54b4a4d54265dab519fd8a5548dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54c9afc8a95cd9fa1e4ce4ab55dcc4ff

SHA1
79157ce846f0b0c3ae4732b50a25df9ca682875f

SHA256
bb6faed5fda1ec9dbd52294825131dd8ddd644ed1597996b85ccc7627a9da106

SHA512
66f1d622d339c6c4b56741ca7436e76a0205e24840ec17d769e42ede7d0fa578e22b3f5379e18ecc12027907832f3919a080dfee3fdbe6ed940a56a08d9369c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c2424b394f9195d920cec6e569c6303

SHA1
7f05558728e1ac558d7023ec7e05bdeb9c267997

SHA256
14e738b54e28b5586cf879d18936f4a59faba5c508a01c4aeb95dda94b053e76

SHA512
b1be95fee7f105363ad89a1675a29184add881bb0f47c91460347f12613a4f5ef32144964bdd29ba7529bacf640bdd149b788da5da253e6c9fc90b74b8ef5b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f953c7d6151c90830e51e221fe8864c

SHA1
f34d1ca8018e9b3944c6f12779f51bd472eaad6e

SHA256
411f61fe6133cddf83eec3da1870435d26fe60adfd2e0751c357d748bc4afabf

SHA512
3c319fb14b78c8685bd5d68de0418675defb369ef81867cecdab82000415e9630fa0a2e1f319e6e5a115f96ee386856cff6468acd6ed2898f241eacd5cce8218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89d5eaa7a122a955622e4fe3db93a030

SHA1
bb31a543f1d9ecb1100e7f326f8b086eaf8e6a0a

SHA256
bfbabe9463110f70fbf600fd83a7dbaed78ffdbca15bedaa55e549d261b1150d

SHA512
29a9df5130beab7d88961b34914919431cb361f33fdc246f7e11f0baf1be90ec9a818d3c5c9755ca31da36a20165e1c292d0375cfef8f6f5bb615a9e508063af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c0975724a5c07ef30d4b0b0efff84d5a

SHA1
7b150369cf8c629aa4c660420e10156b404810a2

SHA256
ad54330f161c99e85a2aa1f22efaad6bfbf2864d4a24c6a730df883d626226c1

SHA512
6f2b83608e66a968e35d24edbc94564b694f90826a83e215af6786a0ad8f516ee3776dcc6c6076bea1a7a25d47f1c2a024cb6f4cb9f8e00cb202f04c82cd147e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0ef474e829ef711a0addc10963a1ae2

SHA1
bb1cf67b839a0440900c5f3c585b232a444404b0

SHA256
ea37a668fc6d692be60d44c4f04938c7eb196424e26e3d509ae8d99ad40e7972

SHA512
0fcfef5c8c4482562d3262a3c07de897edb4991f200df4c889d4747878d8fbb52440365eb2f5cc3cea284fcf0bb347d6f93ca34334aa45bf021df5f82b6193ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b0e58be49cea1387e7d217757e80ed63

SHA1
9b6b370411e04f703d8521b2bfb59350f5e9ab21

SHA256
35ecd765fab555672702d56617c1f3d68cecaab4076b89faefc6e0a553dc2814

SHA512
3f4b1dc0ceb6270a5230bbab430f64cc03ae2404dae7276f539ca7a7f66c847082ab5a4417cb2e1a4aa6f44d1ca81e9fa6ff2b7fb63c88faf5c5ce6d6450c63a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
72101938ff5cb0124e7b8fcbf5cf771c

SHA1
947c839a6d903749411887a439f23e4262deb2e4

SHA256
f33081a36ec8845eb65a2102147cd65a504d83cbd9b994b785c70ddd08672754

SHA512
40823dc2ebb6b71c7d6db4d9cf5437cce54964dfb14a28ea7120c104a5d534295ecec19f9ad243a585b33011c518f2d9cad3ed817a9093787c3e82105aa6df0c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\activity-stream.discovery_stream.json

Filesize
24KB

MD5
5d73d3093962a5d1f61082b68ae2c48a

SHA1
3d1524321be1353f18603ba0c92d6848e6676e9c

SHA256
858f1b2171dccb259f54f456e4e1564752307f5333202ed6d2fa37e19f1fb719

SHA512
cf9e53408258800fa342819fac3a65f900e53b83878004bf1d798f6f7211a22a37cf3b1ac47b1e4a0bf425aa672fb466dd99e82918bea6ec0b9b019025ceea66

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\55351143949B6D37BEC3B2A3ECEC6665B10319DC

Filesize
25KB

MD5
be0a41725b750649e79f46835bb5a054

SHA1
a3bde77cf58fa833251603b8eb7729d15c5bd38f

SHA256
f64fc2466987f3a491958882f2b3e0a891d8b71492f9ad1d3c7c4fdf9f43b943

SHA512
ca8940862ad5183dc46da2ae02f7e28f5e8099fe7a14ac64816cc9868334df12a2bc4a4158e80201e01909df81bdca8c9df7e4ee2a51f7b04ab0a26e3fca1888

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\9C3385EA8729308CFD5FF8D4236F65C67AF00753

Filesize
29KB

MD5
6a5fe3da58f7682c70be0f682d64c6b5

SHA1
eb113a3739842b774d1fec90b1db33c13ea7f441

SHA256
bd8483af9993a11e4e6142fdef6e1b10fdc845592f7b797fe8be7b3444d087fa

SHA512
06a04404a5d06e92ae70e9a661ad07011375cf5a01fd49087d3d98338263d1e68872d2991e70a94f265f0c7413eda4893d9436ba5ea3cba4f389f577761ac1ef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\cache2\entries\A70DB573373EC56903C50E9BE109C81DC0E6D7CA

Filesize
680KB

MD5
9540ca1dcf13a77e28d08fd592ce3bfd

SHA1
d2d1aaf887b553d1b4fbf50f67ca07fe464a08f9

SHA256
5291a0c6da5b8a8c94d13213d374a52972fec2bf232a9c26d45c58094f3bed23

SHA512
e7a0455afd13e3561c92c702736547009ad5e336a2f98a52f1f7f9a1382524511ff6e0e585c365912d716d3d88d61c971f367268bd2976a3fd332c3a879377ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\42vejdix.default-release\thumbnails\5f2c7e383eabfdc14bb94f6a101b1124.png

Filesize
5KB

MD5
60438998c9ab542ed2810bccec180dda

SHA1
f077e9ec35b62c21374930e5ee3508180a63eb2e

SHA256
dfe2d1e85fd27a315a2fd05f087799619f9501803bc606bc059be8ea33e941c3

SHA512
8f231b48776f18408342337fd96be3db9fe1888dcbd05390cd708fb683348d8160ab02b7b1d3f38db3c5c4b7d2439ff3ed8a0b87f2c142aa2d56e0ab5b6cb05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\c42dc2a1-9cb0-4611-8d63-622e64470483.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4512_994348596\8d3ca48e-6456-48d8-a561-8ab7c9e229f4.tmp

Filesize
135KB

MD5
3f6f93c3dccd4a91c4eb25c7f6feb1c1

SHA1
9b73f46adfa1f4464929b408407e73d4535c6827

SHA256
19f05352cb4c6e231c1c000b6c8b7e9edcc1e8082caf46fff16b239d32aa7c9e

SHA512
d488fa67e3a29d0147e9eaf2eabc74d9a255f8470cf79a4aea60e3b3b5e48a3fcbc4fc3e9ce58dff8d7d0caa8ae749295f221e1fe1ba5d20deb2d97544a12ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4512_994348596\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
10KB

MD5
3955f2d7437e35424b5bd638f8d28d56

SHA1
82f8e9aa2bf0bd0aea747c5ca1b7b7392bc2c4b5

SHA256
fe190062e24a467afa2b171267d1b43fafcd62d2f18a7ee897c093f00f1c11e6

SHA512
215d34bdf86735113f2bf7e6c09acce11caf2775158aa4f55c4d8dfeae9079a939121edaccc57e0a5518382711520b5d6c9dfa0a6883a864f323bb2625fff49b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\AlternateServices.bin

Filesize
6KB

MD5
a5b8c2cf523b97557dc9d0cfa1534831

SHA1
38ade8e51b5e4c5fdb50a68802cc8112ec94c2f4

SHA256
3ab4356fd08fca04135ad2ac8e2e42c3c403bd01abda969562eae5daf1be9ee4

SHA512
7de5f628b7718ba9630969b6fd408a8f59ab8288397f80de61aea4d510287b2c293cb3ec244f01dd11080c7bcb3cf7c2c0451968fd8de30f4a14ad6a3d5b7477

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
d662bb7a776aea44d8d3eac1fd87eea6

SHA1
81569d926d1412eef8768d8ee764595ce66272b6

SHA256
faca62d01e2f88ad538b3070cdb0d307e3a03734b17105305bcbd2108bf388d5

SHA512
befeb57624b230104165cc5cb32c16eb4af1fbf018382ecbc6841ca3cf1321c85d7f0965887bd66d7fb30d8c1b0e9e0b7a250d2b1852df878f3f0f9325666420

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
21KB

MD5
31f051b4398c323dc87ab30030c57f09

SHA1
c211a668dadf76edf0e79f9f8a1f1e996eb7476f

SHA256
a5ff49d89053acc8d9b109abda27f1fa9cf8be581481a15b2976111fa16ab979

SHA512
4b6a5b9a074bd1550dc019895523c401278a7cfa3bfd09b7da48a5f2672e0942e3ec08a417ffe4e4c4bc8fdc888820555ee17356ca71eb14b54be75a3eb2849f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
22KB

MD5
fd985a96800fb6b470bbaa762855d501

SHA1
24ea56e3c375fa4053fdc6b58255e140c86e52f9

SHA256
69a70177996710d2eb9cd95835a0628734b9d1b10a9b9efdb97ccbf4ea8d1135

SHA512
b2269f74bb2228d8dba17994d61d3d7ceb9601c3d938d81b372d8cafeb4c6ba094435d33278ee25d2e7343cb4c26082c24aa6f673bf4eb19dfd32f603985f3f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\db\data.safe.tmp

Filesize
23KB

MD5
1a79bec50c6b87cd20e386cce841e30a

SHA1
2da5c2ec129eb6ce4813b8376805f015b13b273f

SHA256
0d09a478c53db428e147243f27bd65bde31bb2b0e90d95718a138cd696bb286c

SHA512
23610ac9a50b811312f26a33075daacbb045c93ee0c535eb5e454cc5742e142f072a1d76bdef9e3220275576623941e2dd46f12401fad4b070d79b59f46333d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\3b348320-37cb-4651-8625-f36c41636da3

Filesize
659B

MD5
5e974c2f93a4b585a584f9a817621aa0

SHA1
51142c80342011b9a45b58971957c22741edf771

SHA256
015d2ec7ce33242f04d0b937eaca55ab937905046e995c69509b18f016d8d5f3

SHA512
762c36414a71b1841502b16e20d0fe7aa86d1b77cadcfd244f5255ec89cb8af9c7edf6ff7a78618ec21abf632acbc6f552f6e8e42b974a9db9812fddfdd9700b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\datareporting\glean\pending_pings\c2782045-0c6e-4fdf-9a21-93c9a54530ff

Filesize
982B

MD5
22a0958742db79f738450c8352fcb77b

SHA1
d06b1c5e7c7cf44f8e5b9d2926cf8861b0ccf4a5

SHA256
b58822a8e86dc60cf97df93dd53328117856f63d8a77351849758fcf22b2e7e8

SHA512
e467ea98012f16c1daa2f2969c2a55abc1e639b01c3dc16f48d14186467882d07007060404485a18dc21742d7818243cff18cd85d63a50dc54338d9bdb2b2426

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
11KB

MD5
a8f0d7e781bf31069a06a6666b1c0dfe

SHA1
36630c9bc9e52e82f790233cf240e2d86bc8f0ed

SHA256
5a5fb0e14afcecd9aa34d86dc310909f404683a293fa74e91cad4a5b33d162fc

SHA512
dfe3ac96a2ac18ec647d5c7e76f1681ea6ad71e5791aa61073f476af3335957ba6fbf2ab60b851e65d717b4f4d05d6dd529e81a40645682c11a76c41c4607c68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs-1.js

Filesize
10KB

MD5
343125de76feffaea273347eba3370d7

SHA1
d55e358b4cb7809948348564d459ec7411236033

SHA256
aee8be1a6f8c46e4bc1129a36b4d1e7c27adbe4ea454e98ec3dc2f9fd1bcbbeb

SHA512
e2d214337c8d86fbb955b104f824f60bce93e661289290ef608f8e381c5ed5382acc1cad2bee8303d12936dfc7c752c140328ccb09ba169b503e0b2d2fac1d42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\prefs.js

Filesize
10KB

MD5
748bc590271299a049b099b39fd5874f

SHA1
8e7aa0c0590a228e6852573bf8d05d0cc116cf95

SHA256
9343de967549dde6750de0ce46dc7815bc65333b30f68981a17eeb2b5e0da753

SHA512
49fc517ff2da704fff8e158cf27699a491ce88bce40744655b06757d1b7da7b504359d61db0c5f9ca839594821343e6e45376227820f9b34f885535d751c40bc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
9a9c7b0927bd3776db6c1ab36b9528cd

SHA1
29d9373b9640a72a6031c4fbf1c30672871169e0

SHA256
abd804305f25fa13c315af666586fc62bb4da95a1fb1362e365eac8c70428afc

SHA512
52230941ad9a7a20b8aeb2051f670f2bd64f289c114fbc1ff6a323623139526d1827becaff99465a46f642b002704a7fafbde94934ae0872c6dd1a053def1c60

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\42vejdix.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
dbc8fd01278c1c4f4a3e0e3947fe9bf3

SHA1
3df743f41b463078649fe50a4de48233a3f8526e

SHA256
1604b3f2b110dcec0200ca8fb9f589b61c2e8663d6cb98296b7d268c79845373

SHA512
d421828fc163cd9fc9d031c1e0c7c1744f00b5409014f54a7e6beb9a163451c3aac5c0d6aca6116204a72438ea2d414c7e9750a4177ad3448db734f85fa58818

Download Submit