Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/12/2024, 17:05

General

  • Target

    file.exe

  • Size

    1.7MB

  • MD5

    99dbc3dc8a5a570531e619921a3da5a4

  • SHA1

    955d1394d9074948e6f2a4ba90d316930580d9b9

  • SHA256

    f9f42f3b2bf9665693451da26453f988ab5f0c636929bc5e39203e24e65e9b92

  • SHA512

    36da7b98b3ac918f33498fc3f46b0e1c0790580b223ad1600c53dfba8e9078a69984b65f259d20e164ed34d0b7b386f2983558d84069d007b8858ec63c242e03

  • SSDEEP

    49152:ysR/aPxLFEKpzqkSxuyyT5HVaa58OsVa8tC:ysRHCqBxup58OsVa0C

Malware Config

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 27 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 35 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7fb9758,0x7fef7fb9768,0x7fef7fb9778
        3⤵
          PID:3024
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:2880
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1364,i,16186538872174045005,2076879974693907819,131072 /prefetch:2
            3⤵
              PID:1416
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1364,i,16186538872174045005,2076879974693907819,131072 /prefetch:8
              3⤵
                PID:2420
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1364,i,16186538872174045005,2076879974693907819,131072 /prefetch:8
                3⤵
                  PID:1040
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2180 --field-trial-handle=1364,i,16186538872174045005,2076879974693907819,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2536
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2400 --field-trial-handle=1364,i,16186538872174045005,2076879974693907819,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2216
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2444 --field-trial-handle=1364,i,16186538872174045005,2076879974693907819,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1296
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1404 --field-trial-handle=1364,i,16186538872174045005,2076879974693907819,131072 /prefetch:2
                  3⤵
                    PID:1872
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:2020
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7e69758,0x7fef7e69768,0x7fef7e69778
                    3⤵
                      PID:2552
                    • C:\Windows\system32\ctfmon.exe
                      ctfmon.exe
                      3⤵
                        PID:2108
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1076 --field-trial-handle=1376,i,3684025048663535040,146773309919933825,131072 /prefetch:2
                        3⤵
                          PID:696
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1464 --field-trial-handle=1376,i,3684025048663535040,146773309919933825,131072 /prefetch:8
                          3⤵
                            PID:1536
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1376,i,3684025048663535040,146773309919933825,131072 /prefetch:8
                            3⤵
                              PID:1960
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1376,i,3684025048663535040,146773309919933825,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2288
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2488 --field-trial-handle=1376,i,3684025048663535040,146773309919933825,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2508
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2620 --field-trial-handle=1376,i,3684025048663535040,146773309919933825,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2120
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1792 --field-trial-handle=1376,i,3684025048663535040,146773309919933825,131072 /prefetch:2
                              3⤵
                                PID:1588
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\KJDHCAFCGD.exe"
                              2⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:2476
                              • C:\Users\Admin\Documents\KJDHCAFCGD.exe
                                "C:\Users\Admin\Documents\KJDHCAFCGD.exe"
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Loads dropped DLL
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of FindShellTrayWindow
                                PID:1616
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                  4⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1856
                                  • C:\Users\Admin\AppData\Local\Temp\1011308001\NK4PJqi.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1011308001\NK4PJqi.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2552
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 656
                                      6⤵
                                      • Loads dropped DLL
                                      • Program crash
                                      PID:3940
                                  • C:\Users\Admin\AppData\Local\Temp\1011316001\DU1zDwm.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1011316001\DU1zDwm.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:5092
                                    • C:\Windows\system32\attrib.exe
                                      attrib +H +S C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                      6⤵
                                      • Views/modifies file attributes
                                      PID:3556
                                    • C:\Windows\system32\attrib.exe
                                      attrib +H C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                      6⤵
                                      • Views/modifies file attributes
                                      PID:3576
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE
                                      6⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3596
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell ping 127.0.0.1; del DU1zDwm.exe
                                      6⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3616
                                      • C:\Windows\system32\PING.EXE
                                        "C:\Windows\system32\PING.EXE" 127.0.0.1
                                        7⤵
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Runs ping.exe
                                        PID:4000
                                  • C:\Users\Admin\AppData\Local\Temp\1011339001\vvcWObH.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1011339001\vvcWObH.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1528
                                    • C:\Windows\system32\cmd.exe
                                      "cmd" /c wmic path win32_videocontroller get caption
                                      6⤵
                                        PID:3180
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic path win32_videocontroller get caption
                                          7⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2212
                                      • C:\Windows\system32\dxdiag.exe
                                        "dxdiag" /t C:\Users\Admin\AppData\Local\Temp\dxdiag.txt
                                        6⤵
                                          PID:408
                                          • C:\Windows\SysWOW64\dxdiag.exe
                                            "C:\Windows\SysWOW64\dxdiag.exe" /t C:\Users\Admin\AppData\Local\Temp\dxdiag.txt
                                            7⤵
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1700
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 1528 -s 1556
                                          6⤵
                                            PID:2956
                                        • C:\Users\Admin\AppData\Local\Temp\1011363001\3cb8327c11.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1011363001\3cb8327c11.exe"
                                          5⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:3348
                                        • C:\Users\Admin\AppData\Local\Temp\1011364001\a3bbb54d67.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1011364001\a3bbb54d67.exe"
                                          5⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4304
                                        • C:\Users\Admin\AppData\Local\Temp\1011365001\7387bd8473.exe
                                          "C:\Users\Admin\AppData\Local\Temp\1011365001\7387bd8473.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:2976
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /F /IM firefox.exe /T
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            PID:1652
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /F /IM chrome.exe /T
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            PID:4704
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /F /IM msedge.exe /T
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            PID:3796
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /F /IM opera.exe /T
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            PID:3960
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /F /IM brave.exe /T
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            • Kills process with taskkill
                                            PID:4056
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                            6⤵
                                              PID:828
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                7⤵
                                                • Checks processor information in registry
                                                • Modifies registry class
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:600
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="600.0.1483469949\725015983" -parentBuildID 20221007134813 -prefsHandle 1188 -prefMapHandle 1140 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc74a7bb-c636-4796-b4d2-69efaa9f85e7} 600 "\\.\pipe\gecko-crash-server-pipe.600" 1316 112bcb58 gpu
                                                  8⤵
                                                    PID:2368
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="600.1.1404407068\1499924691" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c40d701c-4b89-4b05-a90e-f9636637b353} 600 "\\.\pipe\gecko-crash-server-pipe.600" 1500 d0d5e58 socket
                                                    8⤵
                                                      PID:1956
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="600.2.1185291658\670346724" -childID 1 -isForBrowser -prefsHandle 1972 -prefMapHandle 1968 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80f97235-c0a4-4e92-a74c-31ecc160ff88} 600 "\\.\pipe\gecko-crash-server-pipe.600" 1984 1125f958 tab
                                                      8⤵
                                                        PID:1704
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="600.3.404340201\333627913" -childID 2 -isForBrowser -prefsHandle 2620 -prefMapHandle 2616 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0602b6ae-2fde-4356-9d7c-4bf93d1d84c0} 600 "\\.\pipe\gecko-crash-server-pipe.600" 2632 1cb99a58 tab
                                                        8⤵
                                                          PID:548
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="600.4.579713226\1279145194" -childID 3 -isForBrowser -prefsHandle 3484 -prefMapHandle 3520 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c97e5570-b4e7-4914-b8b9-61637b02a9ff} 600 "\\.\pipe\gecko-crash-server-pipe.600" 3632 1e43be58 tab
                                                          8⤵
                                                            PID:4864
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="600.5.594765003\1395680045" -childID 4 -isForBrowser -prefsHandle 3728 -prefMapHandle 3732 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43100864-d39d-45d2-a336-efca1ec42ea5} 600 "\\.\pipe\gecko-crash-server-pipe.600" 3720 1ef4db58 tab
                                                            8⤵
                                                              PID:4924
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="600.6.694376946\1912447714" -childID 5 -isForBrowser -prefsHandle 3844 -prefMapHandle 3848 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 824 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {961c4ceb-6d36-4e4d-a7df-1407368dc272} 600 "\\.\pipe\gecko-crash-server-pipe.600" 3840 1ef4cf58 tab
                                                              8⤵
                                                                PID:5000
                                                        • C:\Users\Admin\AppData\Local\Temp\1011366001\6759f89933.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\1011366001\6759f89933.exe"
                                                          5⤵
                                                          • Modifies Windows Defender Real-time Protection settings
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Windows security modification
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1008
                                                        • C:\Users\Admin\AppData\Local\Temp\1011367001\ded63bb6fb.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\1011367001\ded63bb6fb.exe"
                                                          5⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Loads dropped DLL
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3500
                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                  1⤵
                                                    PID:1680
                                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                    1⤵
                                                      PID:2256
                                                    • C:\Windows\system32\taskeng.exe
                                                      taskeng.exe {E83FEF4F-1D69-4F7E-8321-E5913476076E} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
                                                      1⤵
                                                      • Loads dropped DLL
                                                      PID:328
                                                      • C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                                        C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3436
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          3⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:3448
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                                          3⤵
                                                          • Drops file in System32 directory
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3484
                                                          • C:\Windows\system32\PING.EXE
                                                            "C:\Windows\system32\PING.EXE" 127.1.0.1
                                                            4⤵
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            • Runs ping.exe
                                                            PID:3884
                                                      • C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                                        C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4388
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          3⤵
                                                            PID:4400
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
                                                            3⤵
                                                            • Drops file in System32 directory
                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                            PID:4436
                                                            • C:\Windows\system32\PING.EXE
                                                              "C:\Windows\system32\PING.EXE" 127.1.0.1
                                                              4⤵
                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                              • Runs ping.exe
                                                              PID:4692

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                        Filesize

                                                        40B

                                                        MD5

                                                        29acc7d11d4391748f3d1253849a2e0b

                                                        SHA1

                                                        3ff5749dfe8a28085a4a40cb88a60e498cbd9175

                                                        SHA256

                                                        8e133e9d24921ee093ae9b9b18270faa284d0adb2d88ee326ec85cb0642ba8e5

                                                        SHA512

                                                        0a6eec4b96e4f9f9886f5607684d94a603f240d5a2964e9f5698bdb8c93eada7c7c6959d0a339c2ebc5c21069412074199b26ef82969222ae1700150134eeaac

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

                                                        Filesize

                                                        16B

                                                        MD5

                                                        979c29c2917bed63ccf520ece1d18cda

                                                        SHA1

                                                        65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                        SHA256

                                                        b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                        SHA512

                                                        e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                                        Filesize

                                                        16B

                                                        MD5

                                                        18e723571b00fb1694a3bad6c78e4054

                                                        SHA1

                                                        afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                        SHA256

                                                        8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                        SHA512

                                                        43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        60e3f691077715586b918375dd23c6b0

                                                        SHA1

                                                        476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                        SHA256

                                                        e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                        SHA512

                                                        d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

                                                        Filesize

                                                        32KB

                                                        MD5

                                                        69e3a8ecda716584cbd765e6a3ab429e

                                                        SHA1

                                                        f0897f3fa98f6e4863b84f007092ab843a645803

                                                        SHA256

                                                        e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

                                                        SHA512

                                                        bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

                                                        Filesize

                                                        48B

                                                        MD5

                                                        e1a0aa426b97ddd131fa0b94b9e20be7

                                                        SHA1

                                                        f0a8a23a07573b953bdaae96f2cbe8bd387fcc34

                                                        SHA256

                                                        474663585ba0988c2d0b157e55a2ef45dc78c9d9c38810bcdf18940ad16588cb

                                                        SHA512

                                                        b0ed9a10f577c119084e4dde7569519e8fce4a22b78cb1029eae0595e044160273e61e2db45f115731a5de8fa2df7717bdcf1f5ad8031312ec54546d640836f9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000003.log

                                                        Filesize

                                                        76B

                                                        MD5

                                                        cc4a8cff19abf3dd35d63cff1503aa5f

                                                        SHA1

                                                        52af41b0d9c78afcc8e308db846c2b52a636be38

                                                        SHA256

                                                        cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

                                                        SHA512

                                                        0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\LOG

                                                        Filesize

                                                        192B

                                                        MD5

                                                        0e95d889043d38449cb8d0691055505b

                                                        SHA1

                                                        acc663ea73168e2d07f45c2168b0561de19257cb

                                                        SHA256

                                                        ce380f028572e174cc8f4f9864fcc5886f0bac6389afa3f1d384e0c758eca291

                                                        SHA512

                                                        98df41c349fa6e5c5f8201a599e6cf7f248b19e1506b89ce22247c952e04a64f0f43b21a8eba7211672cccf05290d1b1a4a0edaf394328b52dfcb9fa6dd3c6bb

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\MANIFEST-000002

                                                        Filesize

                                                        50B

                                                        MD5

                                                        22bf0e81636b1b45051b138f48b3d148

                                                        SHA1

                                                        56755d203579ab356e5620ce7e85519ad69d614a

                                                        SHA256

                                                        e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

                                                        SHA512

                                                        a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Favicons

                                                        Filesize

                                                        20KB

                                                        MD5

                                                        3eea0768ded221c9a6a17752a09c969b

                                                        SHA1

                                                        d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

                                                        SHA256

                                                        6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

                                                        SHA512

                                                        fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\History

                                                        Filesize

                                                        148KB

                                                        MD5

                                                        90a1d4b55edf36fa8b4cc6974ed7d4c4

                                                        SHA1

                                                        aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                                        SHA256

                                                        7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                                        SHA512

                                                        ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data For Account

                                                        Filesize

                                                        46KB

                                                        MD5

                                                        02d2c46697e3714e49f46b680b9a6b83

                                                        SHA1

                                                        84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                        SHA256

                                                        522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                        SHA512

                                                        60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000003.log

                                                        Filesize

                                                        40B

                                                        MD5

                                                        148079685e25097536785f4536af014b

                                                        SHA1

                                                        c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

                                                        SHA256

                                                        f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

                                                        SHA512

                                                        c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

                                                        Filesize

                                                        204B

                                                        MD5

                                                        2c8e75f321df59446498cd09a062cbcd

                                                        SHA1

                                                        2396e2a8176e4ca090b889beac5bc61a99e9170e

                                                        SHA256

                                                        a87e8dd1a3388bba782b16044694c6f1556c794db8cc05f4adc4ef60520f0309

                                                        SHA512

                                                        1054b1ee1a1347afbd275976f0d33e42bd6681ace540e65806dc0c84c02fe78cff2bc407d093367c8d0fd0b62ae4f07888444243ccbe636957117722ec88292f

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

                                                        Filesize

                                                        46B

                                                        MD5

                                                        90881c9c26f29fca29815a08ba858544

                                                        SHA1

                                                        06fee974987b91d82c2839a4bb12991fa99e1bdd

                                                        SHA256

                                                        a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

                                                        SHA512

                                                        15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

                                                        Filesize

                                                        192B

                                                        MD5

                                                        cc726060246ba75833b31f90ef45224e

                                                        SHA1

                                                        0421f3ec2a2b4c6eae961b2d0188cce825151df7

                                                        SHA256

                                                        f845917f48f922a891636bfd8192f0fd19b1d21e1c352a39f9def601ef9c0c07

                                                        SHA512

                                                        955d3d46022de9891bc66062cbea9b0b0e250b7b3792b5f3a289a320b5e0599b5c97f47337587201dd44ccf85833cc8f3b581946ad71e1c40f7cb9105aff7a55

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

                                                        Filesize

                                                        128KB

                                                        MD5

                                                        44f0283d82d012c2a5bb3cd62f17105d

                                                        SHA1

                                                        1f0dd33a3a2599752604b8db255439ec420d7b92

                                                        SHA256

                                                        03b443c48f4ca65829b967617d1321f6d934252aaeb0cf830c71eb1d528e47a6

                                                        SHA512

                                                        2e4a961d16085f392bb47fbdf8425fba03c22b062fb370925de592459036dc93d5dd5a9dbe4fadc0e5ba5cf36476425e70f635fe05d90724f2f77bed07f2ff49

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                        Filesize

                                                        14B

                                                        MD5

                                                        9eae63c7a967fc314dd311d9f46a45b7

                                                        SHA1

                                                        caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                                        SHA256

                                                        4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                                        SHA512

                                                        bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                        Filesize

                                                        264KB

                                                        MD5

                                                        f50f89a0a91564d0b8a211f8921aa7de

                                                        SHA1

                                                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                        SHA256

                                                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                        SHA512

                                                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\the-real-index

                                                        Filesize

                                                        48B

                                                        MD5

                                                        cfe0fe88a53c6176cd1a3a7cd138fb3a

                                                        SHA1

                                                        850b2ca239c8118700987921015f489158a90744

                                                        SHA256

                                                        fd4599c5d9c6223d5d1688ee185032b37bbb68f886d01589d60c199facb4a7c8

                                                        SHA512

                                                        016b60e28c5dcf6207834747a73eff8a8e7db3cb391daa122637178f131279535e693d42a67b06cfc3200faa9fa9861658613f80211be5a913b63319aa508b44

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index

                                                        Filesize

                                                        24B

                                                        MD5

                                                        54cb446f628b2ea4a5bce5769910512e

                                                        SHA1

                                                        c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                        SHA256

                                                        fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                        SHA512

                                                        8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

                                                        Filesize

                                                        48B

                                                        MD5

                                                        b0f610ac7aaba37a714a7087575e415a

                                                        SHA1

                                                        b47b50a2b7078684002528839f1b5ad9c6b9be9a

                                                        SHA256

                                                        646fb2dc4a7a844eb6eda0f1ddb1cc75db09b4db4519a714ce1492a1d0cb3cb6

                                                        SHA512

                                                        e64124a322dfa08d16a42188257ecc0c4f7bdfbfbe43d1642760a7f1f5dba0cf4c16e374b5a4a3986cff42f035bcabe0073a8d7fbedde21e3ee133a7d8fe2781

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000004.dbtmp

                                                        Filesize

                                                        16B

                                                        MD5

                                                        6752a1d65b201c13b62ea44016eb221f

                                                        SHA1

                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                        SHA256

                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                        SHA512

                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

                                                        Filesize

                                                        193B

                                                        MD5

                                                        6bbb69de0d871a78c38d32c9d58d80eb

                                                        SHA1

                                                        531887b1eef413480bed1d29024eff7d969cf2f1

                                                        SHA256

                                                        5c66087543e20f299bc33c2729d5bde8569c7e5e05d44279d60a7fb4ee497f71

                                                        SHA512

                                                        b10bb0a5f67d05bc716a93ba51b4aceeb71d0ff87526040ed540fb1edd8b03da7db6938b970a1e30fa4524458641306a875fc95e8dcbc07d3cdd443aeaa86bac

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000002.dbtmp

                                                        Filesize

                                                        16B

                                                        MD5

                                                        206702161f94c5cd39fadd03f4014d98

                                                        SHA1

                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                        SHA256

                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                        SHA512

                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\CURRENT

                                                        Filesize

                                                        16B

                                                        MD5

                                                        46295cac801e5d4857d09837238a6394

                                                        SHA1

                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                        SHA256

                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                        SHA512

                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

                                                        Filesize

                                                        205B

                                                        MD5

                                                        cde54400bd84d95b9babb96baabe71ff

                                                        SHA1

                                                        8561350d90fd98e91f9eacec6118eaba32bb0fe7

                                                        SHA256

                                                        a72fa22ba4c7309bbb94ef07de7581ba3eeb210806ac817e0ee977c48e0f43c8

                                                        SHA512

                                                        ce687dcb7ff2d8639e625e985dc36a45b5652d6ddbafeeebf48ce2871d9cda12ff22037fe888c7aa4190fb16b7149960e49cfd0d7101f78412672802c58a1a16

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000001

                                                        Filesize

                                                        41B

                                                        MD5

                                                        5af87dfd673ba2115e2fcf5cfdb727ab

                                                        SHA1

                                                        d5b5bbf396dc291274584ef71f444f420b6056f1

                                                        SHA256

                                                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                        SHA512

                                                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

                                                        Filesize

                                                        193B

                                                        MD5

                                                        b5bf8de7f35d56c1497e68458df78140

                                                        SHA1

                                                        b86a385f62950e9197ad4ea180f46e51d4169614

                                                        SHA256

                                                        50482d349125d65a605ccac22a781f17cdaa7b09165dfe386ebe8f6f777c66ac

                                                        SHA512

                                                        de9fafcf88185b061728debc537ab75d2512bb8ac9a335080915ca05519c765b303f5e466ca17e828aa555bbb5be2d4e604c3c93cd742191312d246e97bef37d

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

                                                        Filesize

                                                        128KB

                                                        MD5

                                                        c28e6e3f9b033be9b839d8c82acc6157

                                                        SHA1

                                                        a97ea26f3ecc69118cff5376390a19950ee6d243

                                                        SHA256

                                                        7b2cdfce744d89aab9f4605c6cd84f66b3b50296e3f76406aea772829a47db06

                                                        SHA512

                                                        abfa945bf1d3ad5d3bfdea850866302a78c92323850b0206562727ba93725758b4c843345a0feabe1129c06eedfe6e339b0cd8b2ecf7d8598748994f920ab942

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Web Data

                                                        Filesize

                                                        88KB

                                                        MD5

                                                        11b6879796f062d38ba0ec2de7680830

                                                        SHA1

                                                        ecb0f97f93f8f882966a56589162e328e2c8211f

                                                        SHA256

                                                        871b3dbd6548fda17acf2dcdc284bcd6a118e6f547f0702c801710f268743a61

                                                        SHA512

                                                        ed54facfe77e0491a8102d2846b1854aee645e1848db39b11951555d013984de710c715936518cf04cb5dc0fcc7846dcddb017bba9d299c915008532782034f8

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

                                                        Filesize

                                                        200B

                                                        MD5

                                                        05fe2f80edb96126af11f88039da6259

                                                        SHA1

                                                        88e1e2d3bc5d4b0f019220a3e2deb6a94bf09f84

                                                        SHA256

                                                        0d1abe59fac7fc724506a87a47eb7d843dc14146e3ba5a359b2cbbdfa745a7f3

                                                        SHA512

                                                        950c6be8bf53248cbac8662e2d6ce56ee9d63367a9beb5e7f342a923be39fd4421d012c9e4ea1e4d02f1bcf9f77896ae66b1ef46da90465cc6b089ba7ec83c62

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                        Filesize

                                                        86B

                                                        MD5

                                                        f732dbed9289177d15e236d0f8f2ddd3

                                                        SHA1

                                                        53f822af51b014bc3d4b575865d9c3ef0e4debde

                                                        SHA256

                                                        2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

                                                        SHA512

                                                        b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                        Filesize

                                                        2B

                                                        MD5

                                                        99914b932bd37a50b983c5e7c90ae93b

                                                        SHA1

                                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                        SHA256

                                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                        SHA512

                                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9UR26M8S\download[1].htm

                                                        Filesize

                                                        1B

                                                        MD5

                                                        cfcd208495d565ef66e7dff9f98764da

                                                        SHA1

                                                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                        SHA256

                                                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                        SHA512

                                                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\activity-stream.discovery_stream.json.tmp

                                                        Filesize

                                                        23KB

                                                        MD5

                                                        f71d78c9fade18aec5072b8bb5777963

                                                        SHA1

                                                        e83bc783d1935386890c5a9a5c5257126e2298f4

                                                        SHA256

                                                        667971ae7470651c7f2b316f0d21c83a335baead4b3e1b84ff5fdb21c34d86dd

                                                        SHA512

                                                        4dedcb7104215dae81c9986b1ec36b5bfd62e0e61742211e79877a4a539426db44862a0fb4ab42410bb7f5d36d429e9f1a2eafc054fed9f28997172dd9b868d6

                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                        Filesize

                                                        13KB

                                                        MD5

                                                        f99b4984bd93547ff4ab09d35b9ed6d5

                                                        SHA1

                                                        73bf4d313cb094bb6ead04460da9547106794007

                                                        SHA256

                                                        402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                                                        SHA512

                                                        cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                                                      • C:\Users\Admin\AppData\Local\Temp\1011308001\NK4PJqi.exe

                                                        Filesize

                                                        1.5MB

                                                        MD5

                                                        03933b44701e2688a19b6fe5980526b7

                                                        SHA1

                                                        456f586dffa20cc847b3a1f86c2fc958e9cea325

                                                        SHA256

                                                        04510f9d11f433e48517273b05f3f800d73c16bca0b2b4a9afdaf3612550239e

                                                        SHA512

                                                        bb1e6d2e1ffc8ab728295ac07512db3f6a08e0c7f9ec70e65ec75591bb9f697781d0df2096d7f9fc9a4b60b62d427acef46bd9105d713a84f91d33db3bec5d96

                                                      • C:\Users\Admin\AppData\Local\Temp\1011316001\DU1zDwm.exe

                                                        Filesize

                                                        2.2MB

                                                        MD5

                                                        4c64aec6c5d6a5c50d80decb119b3c78

                                                        SHA1

                                                        bc97a13e661537be68863667480829e12187a1d7

                                                        SHA256

                                                        75c7692c0f989e63e14c27b4fb7d25f93760068a4ca4e90fa636715432915253

                                                        SHA512

                                                        9054e3c8306999fe851b563a826ca7a87c4ba78c900cd3b445f436e8406f581e5c3437971a1f1dea3f5132c16a1b36c2dd09f2c97800d28e7157bd7dc3ac3e76

                                                      • C:\Users\Admin\AppData\Local\Temp\1011339001\vvcWObH.exe

                                                        Filesize

                                                        560KB

                                                        MD5

                                                        197feb829312be2d9505c1492b6ddd16

                                                        SHA1

                                                        4e521c36e4fd6c7755d93f8281cc028a980b0979

                                                        SHA256

                                                        2a08227ca39953cd8f967682f4f101f8debdc323b63b37aa1e9ddc38b9009a12

                                                        SHA512

                                                        fa9b18fb32f2892a4844fcf3d29823c1375daca8b3c46ce2dd048e3b11ff2ba2acf6ef73c38e57d16712e75304c8961cf7f2dee4213dc10798f645f9d59c8cb9

                                                      • C:\Users\Admin\AppData\Local\Temp\1011363001\3cb8327c11.exe

                                                        Filesize

                                                        1.7MB

                                                        MD5

                                                        d0f2c0640871f010112184d7e059d71d

                                                        SHA1

                                                        4b15d98aa959f70998734981c6c57a12538c71a8

                                                        SHA256

                                                        cb3d8ee15d2b14e807c77b92a7c48675b1f9524547c163ab787f82aa56ed023e

                                                        SHA512

                                                        f7f355f8593cf8c913638e246698c9a184279ab0eb523c5ae60939ce3387cda78dc6210d1f5eae110269162f75b3b3b196c3dd123e6d69d0e31b34decc9857c8

                                                      • C:\Users\Admin\AppData\Local\Temp\1011364001\a3bbb54d67.exe

                                                        Filesize

                                                        1.7MB

                                                        MD5

                                                        99dbc3dc8a5a570531e619921a3da5a4

                                                        SHA1

                                                        955d1394d9074948e6f2a4ba90d316930580d9b9

                                                        SHA256

                                                        f9f42f3b2bf9665693451da26453f988ab5f0c636929bc5e39203e24e65e9b92

                                                        SHA512

                                                        36da7b98b3ac918f33498fc3f46b0e1c0790580b223ad1600c53dfba8e9078a69984b65f259d20e164ed34d0b7b386f2983558d84069d007b8858ec63c242e03

                                                      • C:\Users\Admin\AppData\Local\Temp\1011365001\7387bd8473.exe

                                                        Filesize

                                                        947KB

                                                        MD5

                                                        05ddc021a4b3ee147c8f107bbe549fa0

                                                        SHA1

                                                        f0dabac9cac119dd4eeb8540f51e92cd3dcfb543

                                                        SHA256

                                                        78bf23bf9328f0dc4d586a8534eadcc7e5db0c227b3bab76af4be20be2aa2722

                                                        SHA512

                                                        cc44c10831296ee0cad1143bc814745d63e872e3668d7f35a520ab43a262c335bd97d77a16374d9bfa514e722e4614b59a8ee0f9c7a068fa2b1b3b8d5e305c81

                                                      • C:\Users\Admin\AppData\Local\Temp\1011366001\6759f89933.exe

                                                        Filesize

                                                        2.7MB

                                                        MD5

                                                        d074af8129d64ccd7455fa7691582b25

                                                        SHA1

                                                        28ab71be91261912fa60093680f852ef29004d48

                                                        SHA256

                                                        79e9912fa56d1e8a79defd3db070450e34a253b2bdc36f7b6eca42bc9cf18fb5

                                                        SHA512

                                                        c2570d7a2f5a3d6f1fecf672e6a1832186fb005a9cbd2a5456382a1ac4906ecc0f2f182cd5e297ef3e3ca79c4b2ada3f85f241886ced64e82925022bbb67444d

                                                      • C:\Users\Admin\AppData\Local\Temp\1011367001\ded63bb6fb.exe

                                                        Filesize

                                                        1.9MB

                                                        MD5

                                                        972aeaccbec56da479e178a53d3b24ff

                                                        SHA1

                                                        af7d676bf5c59c2ac6cfaaaaad067ed34090e675

                                                        SHA256

                                                        c4a071a267dabdb052c37972911874070424f210cd7f3aa6e33cf4e08efbd87d

                                                        SHA512

                                                        53599df300461312f499a4c8ef303724d74417b5d26a9cf189a35dcf6a76d0aa686c8341af6e50c35182d769c2223407cf9076878fbaf52e0f6c2933dff319e1

                                                      • C:\Users\Admin\AppData\Local\Temp\Cab9E71.tmp

                                                        Filesize

                                                        70KB

                                                        MD5

                                                        49aebf8cbd62d92ac215b2923fb1b9f5

                                                        SHA1

                                                        1723be06719828dda65ad804298d0431f6aff976

                                                        SHA256

                                                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                        SHA512

                                                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                      • C:\Users\Admin\AppData\Local\Temp\Tar9F6E.tmp

                                                        Filesize

                                                        181KB

                                                        MD5

                                                        4ea6026cf93ec6338144661bf1202cd1

                                                        SHA1

                                                        a1dec9044f750ad887935a01430bf49322fbdcb7

                                                        SHA256

                                                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                        SHA512

                                                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                        Filesize

                                                        1.8MB

                                                        MD5

                                                        af4ff1c836aa5a2b3e86253a3caa5168

                                                        SHA1

                                                        afc6396f1876b57e13db5f296217189ef3acb20b

                                                        SHA256

                                                        be62b7005f2ddb7339358fdef8a7ffe31111731be81ad6d02f9f58f024dc2654

                                                        SHA512

                                                        9355af2c118edddd7d08109165fc5ea4ce160441ad3035c6e4c22ef43a2115c363fae755e36fe73c83513c0425b65a2a840db65100a11af2343ff2e54668a3b6

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                        Filesize

                                                        442KB

                                                        MD5

                                                        85430baed3398695717b0263807cf97c

                                                        SHA1

                                                        fffbee923cea216f50fce5d54219a188a5100f41

                                                        SHA256

                                                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                        SHA512

                                                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                        Filesize

                                                        8.0MB

                                                        MD5

                                                        a01c5ecd6108350ae23d2cddf0e77c17

                                                        SHA1

                                                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                        SHA256

                                                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                        SHA512

                                                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RQ9FDQUNHX2TG2411TRF.temp

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        c9c415d65670bc4038bcc406050ecae9

                                                        SHA1

                                                        e758e6f72c6c1342698a8d28b3bdbb3b4ba4f624

                                                        SHA256

                                                        70f8ecf25f284bc36c46608d217f3310cb0722eab47f991850dab75af17b891d

                                                        SHA512

                                                        e59535321397746ddd4ce94e30ab16883c17cdc97d7dfdba1fa0a244d39b706c06b4f460c3db82176015ad0a134ed5592e7dd666dc7b8861e3ce3a657e8dc284

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\db\data.safe.bin

                                                        Filesize

                                                        2KB

                                                        MD5

                                                        31e9c10daab916981cbd3583642c1fdd

                                                        SHA1

                                                        19a1e7898caf71735c77dbc03255b0ebaa68e781

                                                        SHA256

                                                        c9fb472c17f116e4ba24a9130c3d255ab0e6f7dc26ab36362b2043d6ba83b49f

                                                        SHA512

                                                        37ac852dc7a38ef917859c44c2dd10593966b86f8319cd4d674069c4358f554f200dd727a1a191d3bdcc6cdce00882cb3aa3acae94b59b3aa221327ef77f1ea8

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\747d9b4c-2ede-45e6-80e1-90b264bcb96c

                                                        Filesize

                                                        12KB

                                                        MD5

                                                        c17f5b31d91b0a021d85a01b1d5aaff6

                                                        SHA1

                                                        6e8de7534d3797d7dfdddd8fe0ab792d5e962a97

                                                        SHA256

                                                        8ba44b3db274fba210b0fe46d9b9a24b6ba44b05becdaffa3bf6030e7bc47cc1

                                                        SHA512

                                                        655eed4b41ff1f52c296308dfd5d2675a61de8a3b372e44268756264d0f321771f8889fc754dcc569d95931ed86cbd60756221ab8e9100442b59292efdc660db

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\datareporting\glean\pending_pings\b4745238-e758-4e36-a994-e3403f3ea312

                                                        Filesize

                                                        745B

                                                        MD5

                                                        884024b0bf3fc3f36aae67a5276890c5

                                                        SHA1

                                                        31252cef37505613521d058cd26c550f7cced265

                                                        SHA256

                                                        f20a27a96dfb29ddae049090b19bf308d2ff94ce914bbca29105415502fd7a0e

                                                        SHA512

                                                        e5784f908272d3cd0fd495f72181fa1ca9fe2783fdf581a91805e7b3cd06301455a5780cffa70d3556d5d3dae2214eb53a5a12b1585798e5136b937e22162227

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                        Filesize

                                                        997KB

                                                        MD5

                                                        fe3355639648c417e8307c6d051e3e37

                                                        SHA1

                                                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                        SHA256

                                                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                        SHA512

                                                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                        Filesize

                                                        116B

                                                        MD5

                                                        3d33cdc0b3d281e67dd52e14435dd04f

                                                        SHA1

                                                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                        SHA256

                                                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                        SHA512

                                                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                        Filesize

                                                        479B

                                                        MD5

                                                        49ddb419d96dceb9069018535fb2e2fc

                                                        SHA1

                                                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                        SHA256

                                                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                        SHA512

                                                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                        Filesize

                                                        372B

                                                        MD5

                                                        8be33af717bb1b67fbd61c3f4b807e9e

                                                        SHA1

                                                        7cf17656d174d951957ff36810e874a134dd49e0

                                                        SHA256

                                                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                        SHA512

                                                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                        Filesize

                                                        11.8MB

                                                        MD5

                                                        33bf7b0439480effb9fb212efce87b13

                                                        SHA1

                                                        cee50f2745edc6dc291887b6075ca64d716f495a

                                                        SHA256

                                                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                        SHA512

                                                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        688bed3676d2104e7f17ae1cd2c59404

                                                        SHA1

                                                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                        SHA256

                                                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                        SHA512

                                                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                        Filesize

                                                        1KB

                                                        MD5

                                                        937326fead5fd401f6cca9118bd9ade9

                                                        SHA1

                                                        4526a57d4ae14ed29b37632c72aef3c408189d91

                                                        SHA256

                                                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                        SHA512

                                                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        d21b0cb1a25535c4b3a5828a3b1c3d1f

                                                        SHA1

                                                        aa5fd4ae7da20061ceb75de420ce6967ccc53392

                                                        SHA256

                                                        5a5d51c55b795efd6cf8ecf55c3299cfc4f7f5aeaff557869c5168e44efeae78

                                                        SHA512

                                                        86ffffb51022a1e50faf5628607cf16f8e17741419740f1bf5d482b760ec686178faf1b4f87dc4ce32b959a04de0a1eeddbb20cef866e9af1b46ee722d30b9b4

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs-1.js

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        de2fd7fc4c7db382b77e5132abb3a587

                                                        SHA1

                                                        6a5ca2530469f5dce7fd4398524f81f2a212152a

                                                        SHA256

                                                        10911aea4b01f8de779d13cb58e4ca709dcb3b68d057c371fbb89a6ed1e2fdfe

                                                        SHA512

                                                        b8defa4cc97c07a08e0359a3069786973e40735f1cf3e521ed303bf98aada97f51469cf500f640cbcf539dd64a03a028b43dbba0ea8e068799ad4ca9adc44844

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs.js

                                                        Filesize

                                                        6KB

                                                        MD5

                                                        6960717c2a3f12b8ea442102e8cc5320

                                                        SHA1

                                                        8540cc41bddef75c04e87c07f95043d6d48c64e8

                                                        SHA256

                                                        d255a9611578a1f068cd841a3d8d22362d77342588dbe822978fde23e72d3f26

                                                        SHA512

                                                        36fccbb67e501eb0a84570d64f3ad473fede8b139db7eb4125eff12310fbfdc5fe2ac34af02d3555dc174e4b2b2990eafec933c7779f9793182a6e9e4b523575

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\prefs.js

                                                        Filesize

                                                        7KB

                                                        MD5

                                                        15fbd0fb043e7d2489b44d85aa07a8cc

                                                        SHA1

                                                        e202a2d99fbb8ee080584afe7cb7e041c7e08cf5

                                                        SHA256

                                                        a9a804f1e672aaa6bda8406fabdbbe608a951c3d6487a7ba1d896d25e32d6df5

                                                        SHA512

                                                        bbd73b095cb46f9acbec7164c6fc353c62d8c574b9d15f5db49cbbfe8129700ea595b294e280578c03f489cefdee9d5ffdce1e05c49364c304e62afb5322761e

                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\sessionstore-backups\recovery.jsonlz4

                                                        Filesize

                                                        4KB

                                                        MD5

                                                        64b5ad96886503d1bc00f7b0a67ed1c3

                                                        SHA1

                                                        4d62516d95d8d25b417c9522055f57ec8fbdce0b

                                                        SHA256

                                                        27392fbe364e2e8bb58110de4e4ea783520d9a557a31872272ac61564fd6e107

                                                        SHA512

                                                        b36659f798511fe54cf205523449a04d80ce6b00f23865676c252cfcf4c2a00b2cc97ac67d9dbec536c544ecaf7c54ef8b36bad2811f7a0f1ef927d4b396b090

                                                      • memory/1008-2048-0x0000000000A10000-0x0000000000CCA000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                      • memory/1008-2049-0x0000000000A10000-0x0000000000CCA000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                      • memory/1008-2047-0x0000000000A10000-0x0000000000CCA000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                      • memory/1008-2079-0x0000000000A10000-0x0000000000CCA000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                      • memory/1008-2088-0x0000000000A10000-0x0000000000CCA000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                      • memory/1528-1747-0x00000000011D0000-0x0000000001262000-memory.dmp

                                                        Filesize

                                                        584KB

                                                      • memory/1528-1748-0x0000000000D50000-0x0000000000DF0000-memory.dmp

                                                        Filesize

                                                        640KB

                                                      • memory/1528-1752-0x00000000005E0000-0x00000000005FE000-memory.dmp

                                                        Filesize

                                                        120KB

                                                      • memory/1528-1751-0x0000000000450000-0x0000000000458000-memory.dmp

                                                        Filesize

                                                        32KB

                                                      • memory/1528-1750-0x0000000000420000-0x000000000042A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/1528-1749-0x00000000003F0000-0x0000000000416000-memory.dmp

                                                        Filesize

                                                        152KB

                                                      • memory/1616-506-0x0000000000DB0000-0x0000000001271000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1616-520-0x0000000000DB0000-0x0000000001271000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1616-518-0x0000000007090000-0x0000000007551000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1616-936-0x0000000007090000-0x0000000007551000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1616-521-0x0000000007090000-0x0000000007551000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1700-1804-0x0000000001DE0000-0x0000000001DE2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/1700-1788-0x0000000001DE0000-0x0000000001E3C000-memory.dmp

                                                        Filesize

                                                        368KB

                                                      • memory/1700-1785-0x0000000001DE0000-0x0000000001E3C000-memory.dmp

                                                        Filesize

                                                        368KB

                                                      • memory/1700-1769-0x0000000001C90000-0x0000000001C9A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/1700-1799-0x0000000001C90000-0x0000000001C9A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/1700-1801-0x0000000001E00000-0x0000000001E2A000-memory.dmp

                                                        Filesize

                                                        168KB

                                                      • memory/1700-1787-0x0000000001DE0000-0x0000000001E3C000-memory.dmp

                                                        Filesize

                                                        368KB

                                                      • memory/1700-1803-0x0000000001E00000-0x0000000001E2A000-memory.dmp

                                                        Filesize

                                                        168KB

                                                      • memory/1700-1802-0x0000000001C90000-0x0000000001C9A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/1700-1786-0x0000000001DE0000-0x0000000001E3C000-memory.dmp

                                                        Filesize

                                                        368KB

                                                      • memory/1700-1783-0x0000000001D30000-0x0000000001D3A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/1700-1784-0x0000000001D30000-0x0000000001D3A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/1700-1770-0x0000000001C90000-0x0000000001C9A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                      • memory/1856-2046-0x0000000006440000-0x00000000066FA000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                      • memory/1856-1789-0x0000000006A60000-0x0000000006EEA000-memory.dmp

                                                        Filesize

                                                        4.5MB

                                                      • memory/1856-1767-0x0000000006A60000-0x0000000006EEA000-memory.dmp

                                                        Filesize

                                                        4.5MB

                                                      • memory/1856-522-0x0000000000A40000-0x0000000000F01000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1856-2098-0x0000000006A60000-0x00000000072E2000-memory.dmp

                                                        Filesize

                                                        8.5MB

                                                      • memory/1856-1723-0x0000000000A40000-0x0000000000F01000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/1856-2095-0x0000000006A60000-0x00000000072E2000-memory.dmp

                                                        Filesize

                                                        8.5MB

                                                      • memory/1856-1810-0x0000000006A60000-0x00000000070E8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/1856-2078-0x0000000006440000-0x00000000066FA000-memory.dmp

                                                        Filesize

                                                        2.7MB

                                                      • memory/1856-2066-0x0000000006A60000-0x00000000072E2000-memory.dmp

                                                        Filesize

                                                        8.5MB

                                                      • memory/1856-2065-0x0000000006A60000-0x00000000072E2000-memory.dmp

                                                        Filesize

                                                        8.5MB

                                                      • memory/1856-1766-0x0000000006A60000-0x0000000006EEA000-memory.dmp

                                                        Filesize

                                                        4.5MB

                                                      • memory/1856-1948-0x0000000006A60000-0x00000000070E8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/1856-1811-0x0000000006A60000-0x00000000070E8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2476-505-0x0000000002090000-0x0000000002551000-memory.dmp

                                                        Filesize

                                                        4.8MB

                                                      • memory/2552-549-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-561-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-534-0x00000000001D0000-0x000000000035C000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                      • memory/2552-1728-0x0000000004E60000-0x0000000004F16000-memory.dmp

                                                        Filesize

                                                        728KB

                                                      • memory/2552-535-0x0000000004D20000-0x0000000004E64000-memory.dmp

                                                        Filesize

                                                        1.3MB

                                                      • memory/2552-536-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-553-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-569-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-575-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-541-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-537-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-577-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-543-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-1729-0x0000000004750000-0x000000000479C000-memory.dmp

                                                        Filesize

                                                        304KB

                                                      • memory/2552-545-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-547-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-573-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-551-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-572-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-555-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-567-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-557-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-559-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-539-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-563-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-565-0x0000000004D20000-0x0000000004E5F000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2552-1735-0x0000000004B80000-0x0000000004BD4000-memory.dmp

                                                        Filesize

                                                        336KB

                                                      • memory/2688-496-0x0000000001150000-0x00000000017D8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2688-2-0x0000000001151000-0x0000000001168000-memory.dmp

                                                        Filesize

                                                        92KB

                                                      • memory/2688-3-0x0000000001150000-0x00000000017D8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2688-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                        Filesize

                                                        972KB

                                                      • memory/2688-0-0x0000000001150000-0x00000000017D8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2688-1-0x00000000774B0000-0x00000000774B2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                      • memory/2688-508-0x0000000001150000-0x00000000017D8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2688-295-0x0000000001150000-0x00000000017D8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2688-390-0x0000000001150000-0x00000000017D8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/2688-242-0x0000000001150000-0x00000000017D8000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/3348-1768-0x00000000010C0000-0x000000000154A000-memory.dmp

                                                        Filesize

                                                        4.5MB

                                                      • memory/3348-1790-0x00000000010C0000-0x000000000154A000-memory.dmp

                                                        Filesize

                                                        4.5MB

                                                      • memory/3348-1851-0x00000000010C0000-0x000000000154A000-memory.dmp

                                                        Filesize

                                                        4.5MB

                                                      • memory/3484-1879-0x0000000002760000-0x0000000002768000-memory.dmp

                                                        Filesize

                                                        32KB

                                                      • memory/3484-1878-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

                                                        Filesize

                                                        2.9MB

                                                      • memory/3616-1734-0x000000001B620000-0x000000001B902000-memory.dmp

                                                        Filesize

                                                        2.9MB

                                                      • memory/3616-1736-0x0000000002790000-0x0000000002798000-memory.dmp

                                                        Filesize

                                                        32KB

                                                      • memory/4304-1814-0x0000000000AE0000-0x0000000001168000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/4304-1812-0x0000000000AE0000-0x0000000001168000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                      • memory/4436-2215-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

                                                        Filesize

                                                        2.9MB

                                                      • memory/4436-2216-0x00000000022D0000-0x00000000022D8000-memory.dmp

                                                        Filesize

                                                        32KB