Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2024, 12:28

General

  • Target

    file.exe

  • Size

    4.9MB

  • MD5

    941507da4995f8296b61a3a35d8b406d

  • SHA1

    a90f5209ca0d56938957ed8f5122de984e6ebbe4

  • SHA256

    50e4484fb6ee4b27ba6e22b5d65e5da71a5699e92999cc0ea450d5c90f3b5361

  • SHA512

    9762bca1fe65fcd816dc08e45a167a3321ee50778161a8241f0f42cb573528d9ffd714857d31192033b25f5654b2f3ec5e655c2238a7756403d77bf227109efd

  • SSDEEP

    98304:39hObHjvS2UhDHtvS2aesYTM/vsobzTwaQH+P6GpuvRI:dw8l+PLA

Malware Config

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

gcleaner

C2

92.63.197.221

45.91.200.135

Extracted

Family

lumma

C2

https://dare-curbys.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://dwell-exclaim.biz/api

https://formy-spill.biz/api

https://atten-supporse.biz/api

https://covery-mover.biz/api

https://print-vexer.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 15 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:332
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6fd9758,0x7fef6fd9768,0x7fef6fd9778
        3⤵
          PID:2836
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:1048
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1292,i,4506364125169869963,9706919685401886328,131072 /prefetch:2
            3⤵
              PID:664
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1292,i,4506364125169869963,9706919685401886328,131072 /prefetch:8
              3⤵
                PID:1464
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 --field-trial-handle=1292,i,4506364125169869963,9706919685401886328,131072 /prefetch:8
                3⤵
                  PID:3060
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2168 --field-trial-handle=1292,i,4506364125169869963,9706919685401886328,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1020
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2468 --field-trial-handle=1292,i,4506364125169869963,9706919685401886328,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:856
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2520 --field-trial-handle=1292,i,4506364125169869963,9706919685401886328,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2292
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1304 --field-trial-handle=1292,i,4506364125169869963,9706919685401886328,131072 /prefetch:2
                  3⤵
                    PID:1328
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                  2⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:2972
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6949758,0x7fef6949768,0x7fef6949778
                    3⤵
                      PID:2924
                    • C:\Windows\system32\ctfmon.exe
                      ctfmon.exe
                      3⤵
                        PID:1904
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:2
                        3⤵
                          PID:1792
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:8
                          3⤵
                            PID:548
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:8
                            3⤵
                              PID:924
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1960 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2820
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2528 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:3008
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2772 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:2900
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1120 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:2
                              3⤵
                                PID:1020
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 --field-trial-handle=1332,i,8400069251150633468,17936544906272057703,131072 /prefetch:8
                                3⤵
                                  PID:1808
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\IJECBGIJDG.exe"
                                2⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:1924
                                • C:\Users\Admin\Documents\IJECBGIJDG.exe
                                  "C:\Users\Admin\Documents\IJECBGIJDG.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Loads dropped DLL
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  PID:980
                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                    4⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Loads dropped DLL
                                    • Adds Run key to start application
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:620
                                    • C:\Users\Admin\AppData\Local\Temp\1012375001\90e3207f53.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012375001\90e3207f53.exe"
                                      5⤵
                                      • Enumerates VirtualBox registry keys
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2832
                                    • C:\Users\Admin\AppData\Local\Temp\1012376001\rhnew.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012376001\rhnew.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1968
                                    • C:\Users\Admin\AppData\Local\Temp\1012377001\7c7738daff.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012377001\7c7738daff.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:572
                                    • C:\Users\Admin\AppData\Local\Temp\1012378001\ed3656f7cc.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012378001\ed3656f7cc.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Modifies system certificate store
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2140
                                    • C:\Users\Admin\AppData\Local\Temp\1012379001\7e2a160b9c.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012379001\7e2a160b9c.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1052
                                    • C:\Users\Admin\AppData\Local\Temp\1012380001\f80b9d46ab.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1012380001\f80b9d46ab.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:2108
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM firefox.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1936
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM chrome.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1484
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM msedge.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2932
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM opera.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1144
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /F /IM brave.exe /T
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2792
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                        6⤵
                                          PID:2212
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                            7⤵
                                            • Checks processor information in registry
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:1640
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.0.2037110945\1758896281" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b7de412-1f8e-4754-9a81-6606829a6d8f} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 1316 10dd7b58 gpu
                                              8⤵
                                                PID:1544
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.1.1524120436\636196497" -parentBuildID 20221007134813 -prefsHandle 1480 -prefMapHandle 1476 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b142b54-2860-4710-ab74-4a530f76a678} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 1492 10d03258 socket
                                                8⤵
                                                  PID:2816
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.2.1112111178\438964596" -childID 1 -isForBrowser -prefsHandle 2024 -prefMapHandle 2020 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0618b240-a5ad-42b5-932c-4c986d62967b} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 2036 18f58758 tab
                                                  8⤵
                                                    PID:3064
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.3.1007091985\1144187204" -childID 2 -isForBrowser -prefsHandle 2580 -prefMapHandle 2576 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fff71b7-7eaa-4b15-b480-3a6da77d6f76} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 2592 1c7e1458 tab
                                                    8⤵
                                                      PID:2684
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.4.391501030\766240419" -childID 3 -isForBrowser -prefsHandle 3928 -prefMapHandle 3952 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59d5e692-99a0-4622-89a8-8c7264059001} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 3884 1ed75658 tab
                                                      8⤵
                                                        PID:3020
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.5.606597780\1421493712" -childID 4 -isForBrowser -prefsHandle 4048 -prefMapHandle 4044 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10651a4a-a3b6-49ab-8780-0fd8c2d02188} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 3968 1ed4ad58 tab
                                                        8⤵
                                                          PID:1704
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1640.6.1640396978\1276211310" -childID 5 -isForBrowser -prefsHandle 4144 -prefMapHandle 3704 -prefsLen 26450 -prefMapSize 233444 -jsInitHandle 792 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17b0bf06-12ec-4496-a962-5c6450339e53} 1640 "\\.\pipe\gecko-crash-server-pipe.1640" 4156 1ed76b58 tab
                                                          8⤵
                                                            PID:2948
                                                    • C:\Users\Admin\AppData\Local\Temp\1012381001\984cb01708.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1012381001\984cb01708.exe"
                                                      5⤵
                                                      • Modifies Windows Defender Real-time Protection settings
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Windows security modification
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3328
                                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                              1⤵
                                                PID:2064
                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                1⤵
                                                  PID:2088

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

                                                  Filesize

                                                  1024KB

                                                  MD5

                                                  c806c4473f82ec409d0d01281513adc3

                                                  SHA1

                                                  a2a0d2dea8fb5429c8eb339d7504936db8b7ed95

                                                  SHA256

                                                  92cd61a571d3eb9dbff4319c293faf68a9a0960bd7efac19cd413df10d0b325a

                                                  SHA512

                                                  febbaad04eaa215c13f624905fa79c93f04057432895a67e93a41343fcbd02da3424713c62b068429d75a6833981c54f1dfa2df81d9d5ec891ab40fdd5bb2895

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  40B

                                                  MD5

                                                  ade370d72a5e4a9155639bd6aa7522f6

                                                  SHA1

                                                  1f3fd4c8c7c358053efb7a665155bfced357badf

                                                  SHA256

                                                  3fa4c0d6a158c0cf88ab17ad09018739515eefc3ff31bffff3414cd50c4a73cb

                                                  SHA512

                                                  5723284b5ac7e7c953f0582598d34b302ce620bcd0f9a4261bc364ce033669eaaee298c47f4a17940710f3e656c7e160c0dc0638b839317e7221427332ef076d

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  18e723571b00fb1694a3bad6c78e4054

                                                  SHA1

                                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                  SHA256

                                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                  SHA512

                                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  979c29c2917bed63ccf520ece1d18cda

                                                  SHA1

                                                  65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                  SHA256

                                                  b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                  SHA512

                                                  e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  60e3f691077715586b918375dd23c6b0

                                                  SHA1

                                                  476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                  SHA256

                                                  e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                  SHA512

                                                  d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  48B

                                                  MD5

                                                  1ddb126f1a54967b4586f9a509edf1ef

                                                  SHA1

                                                  d997edf75b3bb0681f977dac30a5a8927569c90c

                                                  SHA256

                                                  83e9e6f78f2c895cc90e05bbc19c71b344c612258f0f7696ac8ebfd9399c7d70

                                                  SHA512

                                                  35b3e69dc755a4e6e9b774bd156b28ccd9e3163d8f5de173660435070189dfcd2d1db3f22b4e8bb106d8eefd9374f40018d56fffce561b9333de69c9d8d70ba9

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

                                                  Filesize

                                                  48B

                                                  MD5

                                                  a1efab7187ab0fed995a35f421c7541b

                                                  SHA1

                                                  3a32db8f9e626b853e3d762d2ed3abc12e7f2f9d

                                                  SHA256

                                                  3b40edc22a780abe1cb5b9f48f1c8aed598373bb5e42cfcbbe656f9599361e3c

                                                  SHA512

                                                  c28a838ad7cf9e998e11ffeca129762f9bdc5ccf7b6e1f1732f6799b7b059d2222c4d00fd891c4d6362c5aee2272067ca436f9ff2733a744c1a7f8669ee593cc

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Favicons

                                                  Filesize

                                                  20KB

                                                  MD5

                                                  3eea0768ded221c9a6a17752a09c969b

                                                  SHA1

                                                  d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

                                                  SHA256

                                                  6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

                                                  SHA512

                                                  fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Local Storage\leveldb\LOG

                                                  Filesize

                                                  196B

                                                  MD5

                                                  7347db5516ac3fef7e04ffdf626c1788

                                                  SHA1

                                                  fdf903a6371b44a1d52d50ed66c5523a48b8a36a

                                                  SHA256

                                                  0b25fce6b78c095cee4891cd90d27f9da962c151091011e81b028096d90af7f9

                                                  SHA512

                                                  b707f83e7a90bd830823fa26aa5a96f5a89774160d39e27f6b1a2b80e3d10efd2f48feb07069e0f6ab47e103fec331cfb7848c56590f2e7262857606ce0c492c

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Safe Browsing Network\Safe Browsing Cookies

                                                  Filesize

                                                  20KB

                                                  MD5

                                                  c9ff7748d8fcef4cf84a5501e996a641

                                                  SHA1

                                                  02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                                                  SHA256

                                                  4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                                                  SHA512

                                                  d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

                                                  Filesize

                                                  204B

                                                  MD5

                                                  180d9312789df824ceb19630cb713e71

                                                  SHA1

                                                  1014445b75126d284644c8a971a74ec35d2cf464

                                                  SHA256

                                                  0e5872152fe9fdcdbf9695b04c13a8a7f7396e63320315e1a135c9288caf9c9f

                                                  SHA512

                                                  f4a2a69c98158a55f1411fa6e2af6ef47c2f80abd0f7cda76a57cc8a0275c793f80f361e8706e543a4b16e9666b004ecf4cbd91ca13161dfa57bb86545fbc935

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

                                                  Filesize

                                                  46B

                                                  MD5

                                                  90881c9c26f29fca29815a08ba858544

                                                  SHA1

                                                  06fee974987b91d82c2839a4bb12991fa99e1bdd

                                                  SHA256

                                                  a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

                                                  SHA512

                                                  15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

                                                  Filesize

                                                  192B

                                                  MD5

                                                  d930bd8325fa8d8bba1868608bfd2723

                                                  SHA1

                                                  301acbf9ca50fd763770c144b0acc2efe373e823

                                                  SHA256

                                                  ff0ec66b36d4f4419b1806d725600aca7c02fc336ba3725cb11077311adf5f28

                                                  SHA512

                                                  c3c5b82733deadb3c777c407ff748b6a38859fddf6d6d57d8671fe1edda7ca42e9a271a40743486c5be804a14db5e40ccc01f7988be3ffad97412f6eb90eb0b7

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

                                                  Filesize

                                                  128KB

                                                  MD5

                                                  625343e515c124cbea7717946ef59e7a

                                                  SHA1

                                                  7940286fd1b7d89af6a73c1c6f000fa0d19c9717

                                                  SHA256

                                                  a4d3f73f50f5330e2518f0fefdd5579243a7b5de51a805040df7b6995114fae4

                                                  SHA512

                                                  e93c32f0bba80a8a824c8b945b17b7f07b3bf45065950832daf58be178fa291ed8c435fc9f7477b7a1764c6bfbfa892277b12ab1eb140c363008328c2fd22efd

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

                                                  Filesize

                                                  92KB

                                                  MD5

                                                  7fc35bef45f6d888a02ec9955863b615

                                                  SHA1

                                                  95709fd855443abeeb4df4591659a7888d484f22

                                                  SHA256

                                                  be3a9615067db4c11a70566d232ef47cc41c317695337b95a4347f6e054f1e04

                                                  SHA512

                                                  0baecf4cf88e49c80158ae7333c1fbeba94b777ae5740889a45759d102b9af5203843f4bf12920112e3b7aa0753625e2483d3d3648a73d5a2b4c5dc527b03ef2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                  Filesize

                                                  14B

                                                  MD5

                                                  9eae63c7a967fc314dd311d9f46a45b7

                                                  SHA1

                                                  caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                                  SHA256

                                                  4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                                  SHA512

                                                  bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  177KB

                                                  MD5

                                                  3ee3f40fe1951d149f13e0ef26584068

                                                  SHA1

                                                  2d8a54aa37c9a979bb12fb1f3b98fe79cfe73302

                                                  SHA256

                                                  9ea3fd0fb85f8e1b88201e5305fa85ecd35f68c1cd59243b7ffa916e528c1710

                                                  SHA512

                                                  d06aea11bf896e798ac2ebb260d675fa95c5a8c536d8b39a3e0d24bfc1a474e9674299c76c332622a125e032d40ae1b54cf9564fa929cfd26a2633be8f38b994

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                  Filesize

                                                  264KB

                                                  MD5

                                                  f50f89a0a91564d0b8a211f8921aa7de

                                                  SHA1

                                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                  SHA256

                                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                  SHA512

                                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Affiliation Database

                                                  Filesize

                                                  32KB

                                                  MD5

                                                  69e3a8ecda716584cbd765e6a3ab429e

                                                  SHA1

                                                  f0897f3fa98f6e4863b84f007092ab843a645803

                                                  SHA256

                                                  e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

                                                  SHA512

                                                  bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  48B

                                                  MD5

                                                  8104870612e85a0c943d2a19ace60cff

                                                  SHA1

                                                  29d38e76cd7807973e0c4125d25fcdc7a1f2ef89

                                                  SHA256

                                                  40486dbf35f8da9b17272e9b0d0657d3af22ea446db5178d3c714276ec1bdfc3

                                                  SHA512

                                                  40601dd5eab4f2047705bd3a7accf9b38bce3222313b88c5dcb4184382abe6394ca2135422489e1e057030252587cd16b41733e3191c33305aa43c16a4fc9a11

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index

                                                  Filesize

                                                  24B

                                                  MD5

                                                  54cb446f628b2ea4a5bce5769910512e

                                                  SHA1

                                                  c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                  SHA256

                                                  fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                  SHA512

                                                  8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

                                                  Filesize

                                                  48B

                                                  MD5

                                                  8fe6f8708b15875e16159f4f6a957522

                                                  SHA1

                                                  32600414b30c00da5cee6408d6224686e7c042eb

                                                  SHA256

                                                  819845b74a7f20c547b37fbe0722076fe0200a723e83cc906d62af8103104e40

                                                  SHA512

                                                  dc500b21b61e47bc1b59a42bd1d85f7c413151ffd6cfa226e1ad56bda6debc09dd4ab944dfde0fbe0f6a60114246c5bdb850818306f63655b5b61c35fc19e996

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000002.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  206702161f94c5cd39fadd03f4014d98

                                                  SHA1

                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                  SHA256

                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                  SHA512

                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

                                                  Filesize

                                                  76B

                                                  MD5

                                                  cc4a8cff19abf3dd35d63cff1503aa5f

                                                  SHA1

                                                  52af41b0d9c78afcc8e308db846c2b52a636be38

                                                  SHA256

                                                  cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

                                                  SHA512

                                                  0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

                                                  Filesize

                                                  193B

                                                  MD5

                                                  d315a199abeb56edf6560d3587c7dea6

                                                  SHA1

                                                  60c18991aa55e4671be951020f31b89196fc56f7

                                                  SHA256

                                                  1381246fa9c53cbff06256eaf4cfde5a22014a2c51b4b416343e6d9a24119548

                                                  SHA512

                                                  f878111cbb1f7b54ee92f7f35c235c130ede102ee481f4d18ed5d9a8a8b1240c4a19719d6bfb931c555cf63691bf73760f837e621a292e2452293fa7bd3dcf71

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000001

                                                  Filesize

                                                  41B

                                                  MD5

                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                  SHA1

                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                  SHA256

                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                  SHA512

                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000002

                                                  Filesize

                                                  50B

                                                  MD5

                                                  22bf0e81636b1b45051b138f48b3d148

                                                  SHA1

                                                  56755d203579ab356e5620ce7e85519ad69d614a

                                                  SHA256

                                                  e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

                                                  SHA512

                                                  a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

                                                  Filesize

                                                  148KB

                                                  MD5

                                                  90a1d4b55edf36fa8b4cc6974ed7d4c4

                                                  SHA1

                                                  aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                                  SHA256

                                                  7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                                  SHA512

                                                  ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Local Storage\leveldb\LOG

                                                  Filesize

                                                  197B

                                                  MD5

                                                  e5107e2f82da2e6e1ec9306208644c85

                                                  SHA1

                                                  1e32e905f47b2ec58a963d1bda7d5e435cca12a9

                                                  SHA256

                                                  2cf64df0ac9b62dcb5d32c7818d386162da8cbf12a5b71792d900292583f763a

                                                  SHA512

                                                  2758c6de553f260503dfcda2d8f2c14fa4b92338ee84da4e0a5d7f7b97dd3bedc137289b6e629b00427d50a9374842ecd7b600eda51dab670a43a145d751f54c

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data

                                                  Filesize

                                                  46KB

                                                  MD5

                                                  02d2c46697e3714e49f46b680b9a6b83

                                                  SHA1

                                                  84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                  SHA256

                                                  522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                  SHA512

                                                  60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000003.log

                                                  Filesize

                                                  40B

                                                  MD5

                                                  148079685e25097536785f4536af014b

                                                  SHA1

                                                  c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

                                                  SHA256

                                                  f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

                                                  SHA512

                                                  c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000004.dbtmp

                                                  Filesize

                                                  16B

                                                  MD5

                                                  6752a1d65b201c13b62ea44016eb221f

                                                  SHA1

                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                  SHA256

                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                  SHA512

                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\CURRENT~RFf76c38d.TMP

                                                  Filesize

                                                  16B

                                                  MD5

                                                  46295cac801e5d4857d09837238a6394

                                                  SHA1

                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                  SHA256

                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                  SHA512

                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

                                                  Filesize

                                                  205B

                                                  MD5

                                                  b3c56fa1ea4145691b7c9fe5c5984ee1

                                                  SHA1

                                                  1d8ee82df921eb64d6a466f2f2c3d1ce82980672

                                                  SHA256

                                                  e250f0ec7d00017b08185c56667b2dc6b4ba20e030ab717366e101183183f177

                                                  SHA512

                                                  ca664475e34a0207f01317cff152c89edfca29e9cbcd0ccf5b6078f09924643a424c845573fd004ca290b48a8ca9afea04165d7b8e19e4e8b30a4e83d97d6562

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

                                                  Filesize

                                                  193B

                                                  MD5

                                                  993cb7aa0b42b7f80027210fdb572390

                                                  SHA1

                                                  c25953d5401080b72b7caa5f877d7263c3291555

                                                  SHA256

                                                  aa79db9a73d7f5607b81bf1662fae93cb8734c7c07170247f2eabd2229b1e65b

                                                  SHA512

                                                  b8219eec82ac102e5dd3655ac0548923b8934f8bd77e3a85251564d44e1482468336b6b8a12009d0c95ebe24c78a9d2b8e63c10fde9ad135edd36891a946363e

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

                                                  Filesize

                                                  128KB

                                                  MD5

                                                  cec8b89a91469e15506b7e60a168c3a1

                                                  SHA1

                                                  0aff37a8d79bb1d2f2deab08e5a683f7d508bc09

                                                  SHA256

                                                  afd0905d121cf06714c7b1ab093dfb438f2ae737fb2ff2239868f9a094bba99f

                                                  SHA512

                                                  90e1cc9e0f6422a4c1e86f8c355d85034cff3ae05727debdac74f234ad0ca63e4318b4e4d5362dbe27226016f88e6e7e7d4803b22a0d40770217e352b0b55acb

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                  Filesize

                                                  86B

                                                  MD5

                                                  961e3604f228b0d10541ebf921500c86

                                                  SHA1

                                                  6e00570d9f78d9cfebe67d4da5efe546543949a7

                                                  SHA256

                                                  f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                                  SHA512

                                                  535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                  Filesize

                                                  2B

                                                  MD5

                                                  99914b932bd37a50b983c5e7c90ae93b

                                                  SHA1

                                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                  SHA256

                                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                  SHA512

                                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp

                                                  Filesize

                                                  24KB

                                                  MD5

                                                  d5cf6a88a17d750b9ab3fbc0da340fba

                                                  SHA1

                                                  1685cf2ac0941f5342f6ef08dd01708a239ec5c2

                                                  SHA256

                                                  9e879c8e6b78a138b9b33f1ee6b749868cb7daae7333b41d10e7d1ecacd01100

                                                  SHA512

                                                  4fb243eb65891202ca817d2096ca43ba75404767c448b30c19929e075c5e9a6cf28e2cfe3269863e550b65d90cc733cb73378f39319c7987a8f544b9c81da4e7

                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                  Filesize

                                                  15KB

                                                  MD5

                                                  96c542dec016d9ec1ecc4dddfcbaac66

                                                  SHA1

                                                  6199f7648bb744efa58acf7b96fee85d938389e4

                                                  SHA256

                                                  7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                  SHA512

                                                  cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                • C:\Users\Admin\AppData\Local\Temp\1012375001\90e3207f53.exe

                                                  Filesize

                                                  4.3MB

                                                  MD5

                                                  72950603b12d5d99f2ebcedeb3aed5d6

                                                  SHA1

                                                  3587c298d27279b481f9efa0c02be575b6a06599

                                                  SHA256

                                                  76d86e157a4fa1f1b3abf649b931cdc91af733e2b50a863cc9a1dcbb131148b4

                                                  SHA512

                                                  1fbcb1f8793eab0107924f6ec8789eb1752fd39eb4683193b6962803911abbb7ff1d05a362dec349c768e656f7f84144150b06a35e13f74d60afe422cbb407c8

                                                • C:\Users\Admin\AppData\Local\Temp\1012376001\rhnew.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  f7286fef9317fe91e24cda721ec0be81

                                                  SHA1

                                                  0e0197c0f87200f7c1ebb4bba314f7bb875a638c

                                                  SHA256

                                                  4dcf1cc20990dace1f3e7c5a4b94ea7b823f90eb6de639b2b1b6494838f1cc62

                                                  SHA512

                                                  314b3f5cf1a0c15db568d33647b97887b37e987ba253ee9f5ded045446328307ebd04acd832fbdf66ad29be9510bd0c378e2fcb889509dca84df9b9106602c6e

                                                • C:\Users\Admin\AppData\Local\Temp\1012377001\7c7738daff.exe

                                                  Filesize

                                                  1.9MB

                                                  MD5

                                                  2c489e7597e575e7a7ceea0393891de9

                                                  SHA1

                                                  b30bc225ad5c92c184a491971a863fac0ea99491

                                                  SHA256

                                                  6b7c184726f4065c3200e5d2710874c1a1ae816a5c86c354fbec27b7d625c6cd

                                                  SHA512

                                                  1a63aa6332ebceed7bff5d0c6aeefacf7ceb829fb0b762ee1c30163f679eb44c43f1cbfad5ae19bdddcf3e5fde7567f1107a6ab8ede57f442eab703ee689fcb2

                                                • C:\Users\Admin\AppData\Local\Temp\1012378001\ed3656f7cc.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  8679b0deef4b3d4f9cd8f90d0b339072

                                                  SHA1

                                                  ca4b77ad94e677808c5f830c0dd1912c0ae73636

                                                  SHA256

                                                  0d1fea700dd2a7efde5e2b34ad0416bcb65200b6253297c9b3fa157ca7d581b3

                                                  SHA512

                                                  502f101ccc1ba0fc03d6f68dd19768befc7ff84be3a0eba94ee66d0b75465ad48543636e486e9dd7cb879150b449ae324b7ee924e379bd3c43e9488b2a411b20

                                                • C:\Users\Admin\AppData\Local\Temp\1012379001\7e2a160b9c.exe

                                                  Filesize

                                                  4.9MB

                                                  MD5

                                                  941507da4995f8296b61a3a35d8b406d

                                                  SHA1

                                                  a90f5209ca0d56938957ed8f5122de984e6ebbe4

                                                  SHA256

                                                  50e4484fb6ee4b27ba6e22b5d65e5da71a5699e92999cc0ea450d5c90f3b5361

                                                  SHA512

                                                  9762bca1fe65fcd816dc08e45a167a3321ee50778161a8241f0f42cb573528d9ffd714857d31192033b25f5654b2f3ec5e655c2238a7756403d77bf227109efd

                                                • C:\Users\Admin\AppData\Local\Temp\1012380001\f80b9d46ab.exe

                                                  Filesize

                                                  948KB

                                                  MD5

                                                  5d07496592fcbb447233327756e6605f

                                                  SHA1

                                                  8b443c3fe93a1da708859be38bb3f54b3b749a55

                                                  SHA256

                                                  844bfb44822d04e6ddfebd86492bb85af519234b1675e178402f7f61723bee8e

                                                  SHA512

                                                  ebbc673400d148251458067b41b9139ab36015a8802724b1e92b3b7196a597807c475fc18b04817ec6fe17ba831a24fcbdd4f561cd879d77a8cdca15e23f5a82

                                                • C:\Users\Admin\AppData\Local\Temp\1012381001\984cb01708.exe

                                                  Filesize

                                                  2.7MB

                                                  MD5

                                                  a5ebf91bcc1e092e07a46d6c90127358

                                                  SHA1

                                                  19459f6f1a555563c2f86d1ddd48072e2f5e32a2

                                                  SHA256

                                                  af6c8125aaedec62ccfc4eec54c4dd8687c4baec2c82b968997c2410f360b553

                                                  SHA512

                                                  5fb412413b505da08effcc0f5e59f53491796d826a14b3e4878b010788aa3c5532dfcacb08c1f248c31466b64e17a62aa9718d8084883fefd5de1ffa3c857b5f

                                                • C:\Users\Admin\AppData\Local\Temp\Cab9761.tmp

                                                  Filesize

                                                  70KB

                                                  MD5

                                                  49aebf8cbd62d92ac215b2923fb1b9f5

                                                  SHA1

                                                  1723be06719828dda65ad804298d0431f6aff976

                                                  SHA256

                                                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                  SHA512

                                                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                • C:\Users\Admin\AppData\Local\Temp\Tar9784.tmp

                                                  Filesize

                                                  181KB

                                                  MD5

                                                  4ea6026cf93ec6338144661bf1202cd1

                                                  SHA1

                                                  a1dec9044f750ad887935a01430bf49322fbdcb7

                                                  SHA256

                                                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                  SHA512

                                                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                  Filesize

                                                  3.1MB

                                                  MD5

                                                  adda161ed911255889132a0cd67b587a

                                                  SHA1

                                                  c1000389b0f756a47b86c67672c4a91dee8670ee

                                                  SHA256

                                                  e3aa3253019a984c83f1e01e43a821e4436eb848a33df82672b29f62f07866a6

                                                  SHA512

                                                  5f8c0e4d2ad1df6d0512289f2cddbbcadf8e9e81b32cb645e235a7e61d1b2c73aa72f80501757172f884b43490425be04339ce7ea03a76b8cd8bda40c8920fce

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                  Filesize

                                                  442KB

                                                  MD5

                                                  85430baed3398695717b0263807cf97c

                                                  SHA1

                                                  fffbee923cea216f50fce5d54219a188a5100f41

                                                  SHA256

                                                  a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                  SHA512

                                                  06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                  Filesize

                                                  8.0MB

                                                  MD5

                                                  a01c5ecd6108350ae23d2cddf0e77c17

                                                  SHA1

                                                  c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                  SHA256

                                                  345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                  SHA512

                                                  b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  898c309cfa1a5654a602b125824a0fd9

                                                  SHA1

                                                  9e69d52191980b117393fb3d6557f3bdfab81c5a

                                                  SHA256

                                                  52e5655acca316fca0087e2fce86c3d1b6d2eeee0ecf151cc6b9cfc894ad113a

                                                  SHA512

                                                  bdbcf9f2678206f53b5233b4d1b4e05eea98448bf4f2df6e2fcab3876b2ad2c03619f4c6fdde7386ad3f61bbee2ff7ef240869a6bb904051f98d9d041c46ee91

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\1f811a2e-2286-46d1-a0eb-a07ad1bd07b8

                                                  Filesize

                                                  745B

                                                  MD5

                                                  dd76f9db5c669a43ea0cc0081451fd9a

                                                  SHA1

                                                  6e45fdd58f7d4dac57b5ef22d0d63ca4f26a4b3f

                                                  SHA256

                                                  7b86d8ba0ff35d190127c0a289d82e7c8c398722bad97233fab02a937e1dd618

                                                  SHA512

                                                  3c693d3b9374678d21c01f321f2e94cfcaf55111c5e0f497e9b6f00003077cb4d8e3de67268d52c5f8c90733c3c268d1c3fadc0262c78583636d8f4cce84b411

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\908308ca-038e-4d49-b665-f5b685deec64

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  b3f5a8a8254923e774dc7e7dfc72f28e

                                                  SHA1

                                                  893218d4c07b4a176444d7d6a79c206fd4400619

                                                  SHA256

                                                  f30df4de6043909aadb070e839b4ee9304548cb9e23a3b0f65e41f72d156841a

                                                  SHA512

                                                  cc07e2cd098228df582f88b93819962a9f25ab0d15b13e828ff19c1226125ca0e5a6ee4123bbb16143e73d062416a3675aa16a53a9b5bfbf964beaea043f58df

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                  Filesize

                                                  997KB

                                                  MD5

                                                  fe3355639648c417e8307c6d051e3e37

                                                  SHA1

                                                  f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                  SHA256

                                                  1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                  SHA512

                                                  8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                  Filesize

                                                  116B

                                                  MD5

                                                  3d33cdc0b3d281e67dd52e14435dd04f

                                                  SHA1

                                                  4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                  SHA256

                                                  f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                  SHA512

                                                  a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                  Filesize

                                                  479B

                                                  MD5

                                                  49ddb419d96dceb9069018535fb2e2fc

                                                  SHA1

                                                  62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                  SHA256

                                                  2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                  SHA512

                                                  48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                  Filesize

                                                  372B

                                                  MD5

                                                  8be33af717bb1b67fbd61c3f4b807e9e

                                                  SHA1

                                                  7cf17656d174d951957ff36810e874a134dd49e0

                                                  SHA256

                                                  e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                  SHA512

                                                  6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                  Filesize

                                                  11.8MB

                                                  MD5

                                                  33bf7b0439480effb9fb212efce87b13

                                                  SHA1

                                                  cee50f2745edc6dc291887b6075ca64d716f495a

                                                  SHA256

                                                  8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                  SHA512

                                                  d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  688bed3676d2104e7f17ae1cd2c59404

                                                  SHA1

                                                  952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                  SHA256

                                                  33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                  SHA512

                                                  7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  937326fead5fd401f6cca9118bd9ade9

                                                  SHA1

                                                  4526a57d4ae14ed29b37632c72aef3c408189d91

                                                  SHA256

                                                  68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                  SHA512

                                                  b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  61ee612b87224d5a65bdce94a506fbad

                                                  SHA1

                                                  09cd79f4040308498f13a9c447c117ac3d45ddb9

                                                  SHA256

                                                  9b6b4b3e54a4f06e04c683715baab79207c3df596e24d0ca2f6522fc84f34828

                                                  SHA512

                                                  759863529fd15324e5f6e632da4540343f5240b4799b55a8ccd7fa67076d1608525d3280e75ecc238d3e63e18fcccfe074aa45147ef021c578309d8d276c85a3

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  ee7b7d25ec0abe4fc76db251162ed22d

                                                  SHA1

                                                  bcd3e6a48b31ba5610380abb60be15f3ae8b33c3

                                                  SHA256

                                                  030c73f6fd05fa9bbd0ad7db4fc0f4a72815f32a56b4309b235207e58ece9357

                                                  SHA512

                                                  726fa4d3f7cd51d52907fd5cb5a25c3929fdb723b6560813480f46984f546ebfc37a20b43e09d47a05e000d8454779225c3ce8f87aa8c772e5a7e62f6df6c05b

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  abe450092d5cf0efdfb1b4fb6457a356

                                                  SHA1

                                                  7fba4db7471e224927f5c7bb886f592b436159d5

                                                  SHA256

                                                  07eeae2b0f5ac10ec17a6e2ec95601d4165c58ef89f6015f735ace00b7c7ddb0

                                                  SHA512

                                                  3fc70f8d2d94736e8995247851133a80473afa2f8780c61d2dcad767de453179b5f98710e3f6c677644013fbf2795ee555554b5e68949929ddbf86b30669f797

                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4

                                                  Filesize

                                                  4KB

                                                  MD5

                                                  1264d5808ede396ef8075a6e20035d2d

                                                  SHA1

                                                  9dbbb302bf21f2856f9f892cd4a4df01ed1a9b88

                                                  SHA256

                                                  04d9dbf58c450cb9cfb402b603efda089566e3fc086353c57807b7452cef6930

                                                  SHA512

                                                  f47a8a4a10d41314a3856d39d9f69bae633cf6584dd5626e26f1d0073207117b7bd341da6c0288fe2a0500f872c86dbb18e93b0ac7496c84e0db119cb62dbe75

                                                • memory/572-865-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-674-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-943-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-974-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-851-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-956-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-580-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-958-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-607-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-605-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-964-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/572-972-0x0000000000400000-0x0000000000C66000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/620-661-0x0000000006AD0000-0x0000000006FC5000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/620-975-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-562-0x0000000006AD0000-0x0000000006F63000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/620-959-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-604-0x0000000006AD0000-0x0000000007336000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/620-585-0x0000000006AD0000-0x0000000006F63000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/620-606-0x0000000006AD0000-0x0000000007336000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/620-973-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-599-0x0000000006AD0000-0x0000000006F72000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/620-609-0x0000000006AD0000-0x0000000006F72000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/620-548-0x0000000006AD0000-0x000000000779E000-memory.dmp

                                                  Filesize

                                                  12.8MB

                                                • memory/620-550-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-582-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-957-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-967-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-854-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-608-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-946-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-547-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-579-0x0000000006AD0000-0x0000000007336000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/620-681-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-533-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-581-0x0000000006AD0000-0x0000000007336000-memory.dmp

                                                  Filesize

                                                  8.4MB

                                                • memory/620-832-0x0000000006AD0000-0x0000000006FC5000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/620-871-0x00000000011A0000-0x00000000014BF000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/620-564-0x0000000006AD0000-0x000000000779E000-memory.dmp

                                                  Filesize

                                                  12.8MB

                                                • memory/980-516-0x0000000000E60000-0x000000000117F000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/980-532-0x0000000006930000-0x0000000006C4F000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/980-531-0x0000000000E60000-0x000000000117F000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/980-535-0x0000000006930000-0x0000000006C4F000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/980-530-0x0000000006930000-0x0000000006C4F000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1052-662-0x0000000000F00000-0x00000000013F5000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1304-1-0x0000000077930000-0x0000000077932000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1304-254-0x0000000000F90000-0x0000000001485000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1304-253-0x0000000000F91000-0x00000000011DA000-memory.dmp

                                                  Filesize

                                                  2.3MB

                                                • memory/1304-293-0x0000000000F90000-0x0000000001485000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1304-246-0x0000000000F90000-0x0000000001485000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1304-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                  Filesize

                                                  972KB

                                                • memory/1304-519-0x0000000000F91000-0x00000000011DA000-memory.dmp

                                                  Filesize

                                                  2.3MB

                                                • memory/1304-518-0x0000000000F90000-0x0000000001485000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1304-0-0x0000000000F90000-0x0000000001485000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1304-2-0x0000000000F91000-0x00000000011DA000-memory.dmp

                                                  Filesize

                                                  2.3MB

                                                • memory/1304-492-0x0000000000F90000-0x0000000001485000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1304-3-0x0000000000F90000-0x0000000001485000-memory.dmp

                                                  Filesize

                                                  5.0MB

                                                • memory/1924-534-0x0000000002140000-0x000000000245F000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1924-515-0x0000000002140000-0x000000000245F000-memory.dmp

                                                  Filesize

                                                  3.1MB

                                                • memory/1968-656-0x00000000010B0000-0x0000000001543000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/1968-598-0x00000000010B0000-0x0000000001543000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/1968-563-0x00000000010B0000-0x0000000001543000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/1968-603-0x00000000010B0000-0x0000000001543000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2140-652-0x0000000000350000-0x00000000007F2000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2140-600-0x0000000000350000-0x00000000007F2000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2140-655-0x0000000000350000-0x00000000007F2000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2140-831-0x0000000000350000-0x00000000007F2000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2140-846-0x0000000000350000-0x00000000007F2000-memory.dmp

                                                  Filesize

                                                  4.6MB

                                                • memory/2832-549-0x00000000002B0000-0x0000000000F7E000-memory.dmp

                                                  Filesize

                                                  12.8MB

                                                • memory/2832-602-0x00000000002B0000-0x0000000000F7E000-memory.dmp

                                                  Filesize

                                                  12.8MB

                                                • memory/2832-583-0x00000000002B0000-0x0000000000F7E000-memory.dmp

                                                  Filesize

                                                  12.8MB

                                                • memory/2832-578-0x00000000002B0000-0x0000000000F7E000-memory.dmp

                                                  Filesize

                                                  12.8MB

                                                • memory/3328-845-0x0000000000DB0000-0x000000000106C000-memory.dmp

                                                  Filesize

                                                  2.7MB

                                                • memory/3328-844-0x0000000000DB0000-0x000000000106C000-memory.dmp

                                                  Filesize

                                                  2.7MB