Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2024, 17:05

General

  • Target

    file.exe

  • Size

    5.0MB

  • MD5

    513df61631bad61c8b42b93fdd433470

  • SHA1

    0094afdd1c881817a8609bf22fcc026fd23babf9

  • SHA256

    83a33e0e450e20f4b9ce4f12f446f623f71a36864c1de9ecca4a099056be41c9

  • SHA512

    dc5e7093360a5d5e8096672de76ae3808c1936d843a987a33cce4010a846adfbb32acab4c9abe769f8f889156bdfe17b0496b7df69ee41bce25dabab56d84386

  • SSDEEP

    49152:CwRINJLc5c1h56775WmzVJPCUdvyTS6JfOt:Clq+h56775WWVJ6YK2eOt

Malware Config

Extracted

Family

stealc

Botnet

drum

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

cryptbot

Extracted

Family

lumma

C2

https://dwell-exclaim.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://atten-supporse.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 8 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 15 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6ea9758,0x7fef6ea9768,0x7fef6ea9778
        3⤵
          PID:2732
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          3⤵
            PID:2596
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:2
            3⤵
              PID:2816
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:8
              3⤵
                PID:868
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1652 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:8
                3⤵
                  PID:2636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2212 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:1784
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2440 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2884
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2464 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:2264
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1492 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:2
                  3⤵
                    PID:992
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=1304,i,5480075101111934070,16579809668939063120,131072 /prefetch:8
                    3⤵
                      PID:2276
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                    2⤵
                    • Uses browser remote debugging
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:1324
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6819758,0x7fef6819768,0x7fef6819778
                      3⤵
                        PID:1628
                      • C:\Windows\system32\ctfmon.exe
                        ctfmon.exe
                        3⤵
                          PID:1320
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:2
                          3⤵
                            PID:2296
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:8
                            3⤵
                              PID:2780
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:8
                              3⤵
                                PID:2468
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2392 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:2908
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2712 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:2288
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2740 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:2140
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1348 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:2
                                3⤵
                                  PID:1784
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 --field-trial-handle=1204,i,10614925560970481608,7514197069866892986,131072 /prefetch:8
                                  3⤵
                                    PID:2172
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\GIJJKFCGDG.exe"
                                  2⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:1088
                                  • C:\Users\Admin\Documents\GIJJKFCGDG.exe
                                    "C:\Users\Admin\Documents\GIJJKFCGDG.exe"
                                    3⤵
                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    • Identifies Wine through registry keys
                                    • Loads dropped DLL
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1140
                                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                      4⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2820
                                      • C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe"
                                        5⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2808
                                      • C:\Users\Admin\AppData\Local\Temp\1012749001\4b1070f673.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1012749001\4b1070f673.exe"
                                        5⤵
                                        • Enumerates VirtualBox registry keys
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1592
                                      • C:\Users\Admin\AppData\Local\Temp\1012750001\5fad93d4b7.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1012750001\5fad93d4b7.exe"
                                        5⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2464
                                      • C:\Users\Admin\AppData\Local\Temp\1012751001\3989c5b987.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1012751001\3989c5b987.exe"
                                        5⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2972
                                      • C:\Users\Admin\AppData\Local\Temp\1012752001\ab67921dae.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1012752001\ab67921dae.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1980
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /F /IM firefox.exe /T
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:796
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /F /IM chrome.exe /T
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:956
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /F /IM msedge.exe /T
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2608
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /F /IM opera.exe /T
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2660
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /F /IM brave.exe /T
                                          6⤵
                                          • System Location Discovery: System Language Discovery
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2640
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                          6⤵
                                            PID:1996
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                              7⤵
                                              • Checks processor information in registry
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:1560
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.0.1948110215\1933499670" -parentBuildID 20221007134813 -prefsHandle 1260 -prefMapHandle 1148 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6386c1ec-1749-461f-9e5b-0c3a77f0cb2c} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 1372 45d8358 gpu
                                                8⤵
                                                  PID:2688
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.1.1369739293\1085284012" -parentBuildID 20221007134813 -prefsHandle 1528 -prefMapHandle 1524 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49a29aa7-23f2-47ba-bd71-bf0059f6ace0} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 1556 44f9258 socket
                                                  8⤵
                                                    PID:1976
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.2.1845895577\1636710572" -childID 1 -isForBrowser -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 692 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0110c39-4c4b-4d4b-8bb1-e99854765cdd} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 2104 1a197d58 tab
                                                    8⤵
                                                      PID:1592
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.3.1428096272\498373754" -childID 2 -isForBrowser -prefsHandle 2652 -prefMapHandle 596 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 692 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba5b6c3c-5879-4f51-87e1-53a763b39aaf} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 2664 e64858 tab
                                                      8⤵
                                                        PID:1388
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.4.755498588\90598058" -childID 3 -isForBrowser -prefsHandle 3788 -prefMapHandle 3548 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 692 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3beb0ddf-3383-4d89-a710-6c75cd50bd5a} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 3744 1a133558 tab
                                                        8⤵
                                                          PID:2384
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.5.1894214941\308405026" -childID 4 -isForBrowser -prefsHandle 3908 -prefMapHandle 3912 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 692 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5014b2d-391e-4eb5-af0f-4af9c258831c} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 3896 1fcbd558 tab
                                                          8⤵
                                                            PID:2888
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1560.6.1260971846\1154523693" -childID 5 -isForBrowser -prefsHandle 4084 -prefMapHandle 4088 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 692 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4a096e3-9da5-405f-a562-12f3dae4e950} 1560 "\\.\pipe\gecko-crash-server-pipe.1560" 4072 21318758 tab
                                                            8⤵
                                                              PID:1628
                                                      • C:\Users\Admin\AppData\Local\Temp\1012753001\924e51f082.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\1012753001\924e51f082.exe"
                                                        5⤵
                                                        • Modifies Windows Defender Real-time Protection settings
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Windows security modification
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1868
                                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                1⤵
                                                  PID:2672
                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                  1⤵
                                                    PID:640

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    40B

                                                    MD5

                                                    a5ff7b8d3f9da95f3edc95416ad0ee3a

                                                    SHA1

                                                    a1d3fb57133e5369e14db282af76e1c6593cc9b2

                                                    SHA256

                                                    7237c8d0f62cf771e73c5e6099e0ff332f3bd57474348b304390afb190f9fcfd

                                                    SHA512

                                                    d0ac399fbcf673e3045e62b5bdeee954cf08fe562f2aba8c718980b504e00af2cb3c14ee28c719fc46058cb9ede922f373f2d53e585e29c4d7e1d2eecea2898e

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                                    Filesize

                                                    16B

                                                    MD5

                                                    aefd77f47fb84fae5ea194496b44c67a

                                                    SHA1

                                                    dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                    SHA256

                                                    4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                    SHA512

                                                    b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000008.dbtmp

                                                    Filesize

                                                    16B

                                                    MD5

                                                    589c49f8a8e18ec6998a7a30b4958ebc

                                                    SHA1

                                                    cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

                                                    SHA256

                                                    26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

                                                    SHA512

                                                    e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

                                                    Filesize

                                                    16B

                                                    MD5

                                                    979c29c2917bed63ccf520ece1d18cda

                                                    SHA1

                                                    65cd81cdce0be04c74222b54d0881d3fdfe4736c

                                                    SHA256

                                                    b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

                                                    SHA512

                                                    e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                                    Filesize

                                                    16B

                                                    MD5

                                                    18e723571b00fb1694a3bad6c78e4054

                                                    SHA1

                                                    afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                                    SHA256

                                                    8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                                    SHA512

                                                    43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

                                                    Filesize

                                                    16B

                                                    MD5

                                                    60e3f691077715586b918375dd23c6b0

                                                    SHA1

                                                    476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                    SHA256

                                                    e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                    SHA512

                                                    d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Affiliation Database

                                                    Filesize

                                                    32KB

                                                    MD5

                                                    69e3a8ecda716584cbd765e6a3ab429e

                                                    SHA1

                                                    f0897f3fa98f6e4863b84f007092ab843a645803

                                                    SHA256

                                                    e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

                                                    SHA512

                                                    bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    48B

                                                    MD5

                                                    c89f8728df14d7b4a050b20b102012b9

                                                    SHA1

                                                    a91f3fb1000139f83d8e5a35d70e05fce6222782

                                                    SHA256

                                                    5d314b8eaaa16cb31b25df193a46cc16bf0fd9c302c01d73d30918bf50cbc4f2

                                                    SHA512

                                                    ed0fe2208dd03024fd7e37d48e8e22961bd3eb7702e43a51d075899affbad9b6d18d7c4207e3bd17ba0f05f3cc55ec849257ff9d81a4ce1820dc4de2ad4ac0ea

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index

                                                    Filesize

                                                    24B

                                                    MD5

                                                    54cb446f628b2ea4a5bce5769910512e

                                                    SHA1

                                                    c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

                                                    SHA256

                                                    fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

                                                    SHA512

                                                    8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\wasm\index-dir\the-real-index

                                                    Filesize

                                                    48B

                                                    MD5

                                                    078042ef55a5616a53c7fd2a889b4d9b

                                                    SHA1

                                                    1216629cced2113551142ad3f8f86285628bb234

                                                    SHA256

                                                    5811bc136ac83d000b6033674edd4ce2162199f25cf4a2a6656b3b59c21b33e1

                                                    SHA512

                                                    9961d748a6052e0ab2a6b0d1959f38c08582208cd1627ae8c7ff476cdcf0e5047b45f134094fddc5bc93016e69f1449dd956d3e5bace96a390433c7de860e052

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Favicons

                                                    Filesize

                                                    20KB

                                                    MD5

                                                    3eea0768ded221c9a6a17752a09c969b

                                                    SHA1

                                                    d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

                                                    SHA256

                                                    6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

                                                    SHA512

                                                    fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\History

                                                    Filesize

                                                    148KB

                                                    MD5

                                                    90a1d4b55edf36fa8b4cc6974ed7d4c4

                                                    SHA1

                                                    aba1b8d0e05421e7df5982899f626211c3c4b5c1

                                                    SHA256

                                                    7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

                                                    SHA512

                                                    ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Login Data For Account

                                                    Filesize

                                                    46KB

                                                    MD5

                                                    02d2c46697e3714e49f46b680b9a6b83

                                                    SHA1

                                                    84f98b56d49f01e9b6b76a4e21accf64fd319140

                                                    SHA256

                                                    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                                    SHA512

                                                    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000003.log

                                                    Filesize

                                                    40B

                                                    MD5

                                                    148079685e25097536785f4536af014b

                                                    SHA1

                                                    c5ff5b1b69487a9dd4d244d11bbafa91708c1a41

                                                    SHA256

                                                    f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8

                                                    SHA512

                                                    c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\LOG

                                                    Filesize

                                                    204B

                                                    MD5

                                                    b4fde95a1cd95305bd9e81c4b0fce315

                                                    SHA1

                                                    94fd43726e69071341e2008f7a5a3d0d752f3692

                                                    SHA256

                                                    3fad0e68c1315809b132b6d8520da42e41b5a8ce2e0cc9634cb5410b97abc363

                                                    SHA512

                                                    c7cc21bbd204149d4c68ab70a7251b8605baab1dfc57edb6c9eeb03e9c326a2e61b2f3ad0bf93f25778e54b5954576f8e00bba21b68bf91e53c94d6f189077ec

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\MANIFEST-000001

                                                    Filesize

                                                    41B

                                                    MD5

                                                    5af87dfd673ba2115e2fcf5cfdb727ab

                                                    SHA1

                                                    d5b5bbf396dc291274584ef71f444f420b6056f1

                                                    SHA256

                                                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                    SHA512

                                                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000003.log

                                                    Filesize

                                                    46B

                                                    MD5

                                                    90881c9c26f29fca29815a08ba858544

                                                    SHA1

                                                    06fee974987b91d82c2839a4bb12991fa99e1bdd

                                                    SHA256

                                                    a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

                                                    SHA512

                                                    15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT~RFf76d597.TMP

                                                    Filesize

                                                    16B

                                                    MD5

                                                    46295cac801e5d4857d09837238a6394

                                                    SHA1

                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                    SHA256

                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                    SHA512

                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\LOG

                                                    Filesize

                                                    192B

                                                    MD5

                                                    d43b34f23026c050ded8e4e806411aa1

                                                    SHA1

                                                    cbe88fa0ff9e628d4c393a2cb6d89153f38bd032

                                                    SHA256

                                                    a6b4abf2bdfb5575961a3b15238c79a73e79ca4c2d525209739abc87942d6eac

                                                    SHA512

                                                    c1abcd5e9bbc5c86cf9ed0ba216cab63bfdcdbe23b4042e541a7bacda25461344f36028103e5212475badd70e7a4923fae8e6714f138b371c28e64c321c9013c

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Visited Links

                                                    Filesize

                                                    128KB

                                                    MD5

                                                    24eb9cc29bfca90f642ac81848dc6117

                                                    SHA1

                                                    8db04b4fd7c218a005b6138bacd4d0fe4d724a23

                                                    SHA256

                                                    22fb0c89fd3eee10cf3ec6c9cf8817807df2e9fb7dc0ede037b9fc4120c148d6

                                                    SHA512

                                                    e41e16fe723a10c5249a67fa83507fc238b509876af4ef18545b5537e693f834d164a4f6b50ce368d784459625d16bfea6281b75572abcd02e55cf6accf0cbe3

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Web Data

                                                    Filesize

                                                    92KB

                                                    MD5

                                                    5ecb1559e7573689b5cfe1987c62d01c

                                                    SHA1

                                                    1cb8090be5d9a65948c303951974bffeef531185

                                                    SHA256

                                                    5d05a738f369aa9d3cd8271121921d407316a0310869f85a858d65766661f0f9

                                                    SHA512

                                                    41bd240bd3e1305fecc46ed21e4e6ffdbdcb3cf8b514cbcce24ebbc8745501cedb8442043c92d6db8569dd50b8c257a2d3ebd825b0158f5e7fb4c6c7b4a7538f

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\metadata\LOG

                                                    Filesize

                                                    199B

                                                    MD5

                                                    8e60e17af790d88de1a085d7c165a8ca

                                                    SHA1

                                                    8b4dc7fcc35474250b262500fac1f955e9ce6b07

                                                    SHA256

                                                    1081a86c0a21e65ce14cf2c29f5a0e89744e505c0c71348dc8aceb0377d032b2

                                                    SHA512

                                                    a296622e41ed5b56627bf953a85f7cf7dc32186b27a636b8cc0f730023042560aee4a1029681ecc2880df4ba9b66ab00146264b51978cce7f3c48803c47f2b1c

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

                                                    Filesize

                                                    14B

                                                    MD5

                                                    9eae63c7a967fc314dd311d9f46a45b7

                                                    SHA1

                                                    caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

                                                    SHA256

                                                    4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

                                                    SHA512

                                                    bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                    Filesize

                                                    264KB

                                                    MD5

                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                    SHA1

                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                    SHA256

                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                    SHA512

                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Code Cache\wasm\index-dir\the-real-index

                                                    Filesize

                                                    48B

                                                    MD5

                                                    baaa4a659c39833ca125a63a8c96e0a8

                                                    SHA1

                                                    3cec4f87fc11d359a3c03efcb40601323011a592

                                                    SHA256

                                                    2491fb70501bf100183cb6ba29d7c297385acd3bb54090083cfcf609d9af4626

                                                    SHA512

                                                    eea6df64d92c9dbf3d5d0969367c19a5310bb98cf6159ef62303783488e36a104f352575a40c2b9debac2cca1e8bc6a71ce5ddaad5355eb63ed4d75cf5786b0e

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000003.log

                                                    Filesize

                                                    76B

                                                    MD5

                                                    cc4a8cff19abf3dd35d63cff1503aa5f

                                                    SHA1

                                                    52af41b0d9c78afcc8e308db846c2b52a636be38

                                                    SHA256

                                                    cc5dacf370f324b77b50dddf5d995fd3c7b7a587cb2f55ac9f24c929d0cd531a

                                                    SHA512

                                                    0e9559cda992aa2174a7465745884f73b96755008384d21a0685941acf099c89c8203b13551de72a87b8e23cdaae3fa513bc700b38e1bf3b9026955d97920320

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\LOG

                                                    Filesize

                                                    193B

                                                    MD5

                                                    29146254c6ee0bd19b0b4a951c8724b6

                                                    SHA1

                                                    d7c1d01ffbc70ab77c8debbafa57159ef4751909

                                                    SHA256

                                                    588ea14846011c47a171a2f6dfc19d9d82f0d4c8ebb4c1c628f9aeaf8566f80f

                                                    SHA512

                                                    ec2c78a6011717be71b69871ec0c4a4ec285dde77785f99fab42d38b23cab2df715d898407db7fccb195afda10920caa6300d45871813611cc4559365a37fd49

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\MANIFEST-000002

                                                    Filesize

                                                    50B

                                                    MD5

                                                    22bf0e81636b1b45051b138f48b3d148

                                                    SHA1

                                                    56755d203579ab356e5620ce7e85519ad69d614a

                                                    SHA256

                                                    e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97

                                                    SHA512

                                                    a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\LOG

                                                    Filesize

                                                    205B

                                                    MD5

                                                    01262faee5aaabf9582022e09660bec2

                                                    SHA1

                                                    a4a033c4dc97f75be043be0f6cfb7e31e00169a9

                                                    SHA256

                                                    e935a9be05cab9218f05ac8f46b63a8877bbf5c37e60bd880e6f11a746945a34

                                                    SHA512

                                                    833953eae9b458514774878d63cd5793f0b043d16b0e74fbb90a6a3a0ce428d3537f21bf03607fcdc673160360cea244d919ba83f47b386b468d130869dce2bb

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000002.dbtmp

                                                    Filesize

                                                    16B

                                                    MD5

                                                    206702161f94c5cd39fadd03f4014d98

                                                    SHA1

                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                    SHA256

                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                    SHA512

                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000004.dbtmp

                                                    Filesize

                                                    16B

                                                    MD5

                                                    6752a1d65b201c13b62ea44016eb221f

                                                    SHA1

                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                    SHA256

                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                    SHA512

                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

                                                    Filesize

                                                    193B

                                                    MD5

                                                    d9a8b94290167a8022cb09d36415f2c5

                                                    SHA1

                                                    26641016ca5fb66eaa0516b2290d9a5a553c9a79

                                                    SHA256

                                                    609429cbaecff2d8c5df39b29ccc110507c983bfde6a203ae917a4ab68c57ffc

                                                    SHA512

                                                    8ea9b3d317e473acbcb44557f91d8ace7c9069889cbca70374494006384421d794a1769bd3b786c253b80b93493bf41ecd339cc9e4f8b6be7b4362a1cd1afb7c

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

                                                    Filesize

                                                    128KB

                                                    MD5

                                                    6ecdc06a0d3523cd376447908750821f

                                                    SHA1

                                                    4a083ea3623c647ca22c3181c2d0be1b7f1e095c

                                                    SHA256

                                                    6e0eb7aa8af15d43389896c75f9276d9c1c3d4db742fb024aad1316a48f51665

                                                    SHA512

                                                    822afd5810ef7fb0b11077f2337e6761eaaf3134336058bf2356c4bcbd3ec2a422e612d8f718bc1960ff13538e1494b72a695d8fd8b637c9b6cc4dfed24b63f7

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Web Data

                                                    Filesize

                                                    92KB

                                                    MD5

                                                    939f61443e5dc072365f67efd89d7cfb

                                                    SHA1

                                                    97131c8cd489ff4c617d020d46495bcb05b160ae

                                                    SHA256

                                                    677ef4fe4906fde861a8f221f5416a1155fbe5f09197ab0738c118ea358c0a5b

                                                    SHA512

                                                    7e572d07a9b8e91572493ef64d878a75778e3f5f4bafdff55ead452c213bbb2488d08ac78cad70b07d68029f95aba96fb27e424ce13067ece263a2f9314f446e

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\LOG

                                                    Filesize

                                                    200B

                                                    MD5

                                                    00a96fcdc0c4b3eb68f31af4532128cb

                                                    SHA1

                                                    977e7edbf2770f2ef27c3fceaa715606554cf08b

                                                    SHA256

                                                    21a0c68c0f552ba77b01833d2a28b5a7c2cac2a24fc0e4f3d4a51a17d251b5ca

                                                    SHA512

                                                    5d361ee243aafb34d178b1062ea84dd1ce12a9bf1a41699deb9ade004166b7463293231c39b6eb6b08ed851f374da106a9a6eef12182b25b94669e06c0a16c3c

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

                                                    Filesize

                                                    86B

                                                    MD5

                                                    961e3604f228b0d10541ebf921500c86

                                                    SHA1

                                                    6e00570d9f78d9cfebe67d4da5efe546543949a7

                                                    SHA256

                                                    f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

                                                    SHA512

                                                    535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                    Filesize

                                                    2B

                                                    MD5

                                                    99914b932bd37a50b983c5e7c90ae93b

                                                    SHA1

                                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                    SHA256

                                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                    SHA512

                                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp

                                                    Filesize

                                                    24KB

                                                    MD5

                                                    a32cdf726ec67f3362929da513ec46d7

                                                    SHA1

                                                    aab973c0459f68b37ce2752ba7631f19161ca080

                                                    SHA256

                                                    8c93cfc201f305ece61b24e258f36d37b1af01f246a8a48d3ed4a461494417f9

                                                    SHA512

                                                    3d44996f5f5999a3724bbf0d0284446af308ccac7826833c56ef4b8aa0fbe34c5b650b1641b1d72f8e8b5829fad48fbdf502ff69461ea411075bf3a1645ffdd3

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                    Filesize

                                                    15KB

                                                    MD5

                                                    96c542dec016d9ec1ecc4dddfcbaac66

                                                    SHA1

                                                    6199f7648bb744efa58acf7b96fee85d938389e4

                                                    SHA256

                                                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                    SHA512

                                                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                  • C:\Users\Admin\AppData\Local\Temp\1012713001\BY5BeYh.exe

                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    f64bfb2f10922691f73d024caa447e48

                                                    SHA1

                                                    196536819a64cb13c1b78710bfb18cb8be4c5777

                                                    SHA256

                                                    deb36787b95129fcabcd43d10401c2fe47d9e0b30aebf206f83acda4660ac32c

                                                    SHA512

                                                    c688f5e34771bd8ad4b4b86f7c0670f49193fa281c1b56fe6d220131a0c38b4221585e1e38f3dc00d51f286472b3143c9943abd57b6a62dbe8047e8e388ace5b

                                                  • C:\Users\Admin\AppData\Local\Temp\1012749001\4b1070f673.exe

                                                    Filesize

                                                    4.3MB

                                                    MD5

                                                    ac0b9cd9364e29334c54bee967689b1a

                                                    SHA1

                                                    074a6e83089aa60a5d05e5f0f3cb52dd98d01b08

                                                    SHA256

                                                    1f16e15ed40c117aa6468a9e79990e5cef926d0838cf1ce08d860ed6d092dee5

                                                    SHA512

                                                    9940a237e9b2b14c1e853799b47855c467c83cc86487e96a0124fa70a8bc6f2f73d7393debb43ddf0a0b344974c1f725d0136712837050fddfd2f901f587be4d

                                                  • C:\Users\Admin\AppData\Local\Temp\1012750001\5fad93d4b7.exe

                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    71e846ed7065329929684bbf0034b75c

                                                    SHA1

                                                    7e36f675eb73d747598d77c94687faea24875350

                                                    SHA256

                                                    b1fc99711944205a1c0c5725a64c175a428ba8ea406e4731b04924a65b0350c4

                                                    SHA512

                                                    77ea646e0851f5100740c63a293f847c4af8e12694ec037d722806e8c3e65537c194ff6c6535148efe6f257d3d801740d01abf06eb5b6cb1eb16783f986a7fcb

                                                  • C:\Users\Admin\AppData\Local\Temp\1012751001\3989c5b987.exe

                                                    Filesize

                                                    5.0MB

                                                    MD5

                                                    70d4aabe25fc8b78572976f5f2727239

                                                    SHA1

                                                    44c175652596da2d8727b02234e58e0b07c8b6e8

                                                    SHA256

                                                    b10eea39f91ba2a24cbb9a6597e5b583b9d5afcc12518ecebeaa34437a48bd92

                                                    SHA512

                                                    830efb79642ae7215db8b00af321f3d05912a49b8c50c5be080afad52308089669bd6a7c4ba03c8e61cc4e412c39c4e63a2a70b92905dd13a1a2dffd5477414a

                                                  • C:\Users\Admin\AppData\Local\Temp\1012752001\ab67921dae.exe

                                                    Filesize

                                                    948KB

                                                    MD5

                                                    3602953a339c842d0ea0828e71a989c2

                                                    SHA1

                                                    a4f885e954d725c288543035583393a127fb013f

                                                    SHA256

                                                    61409882cbb6335ecd29a7d29a7aa990eeaaf1b5ec51570bae59f5fb9b27f55c

                                                    SHA512

                                                    47d0d98012b2a7006c640b33f1847fdf9c3ca18728d9649b44cf199e6ad6142fd89612a728a45886f5308a56e702b1c5cbf3db9f94e1c6194e2a469a72deac35

                                                  • C:\Users\Admin\AppData\Local\Temp\1012753001\924e51f082.exe

                                                    Filesize

                                                    2.6MB

                                                    MD5

                                                    68523146b4b47b96ff282825374f9fec

                                                    SHA1

                                                    1e3a6f865b92b4f33dac9e9cfd62a72d8e520082

                                                    SHA256

                                                    40035e7558de64b3b0a9e9597ebb635fc570c0007890a82ddd9e412b1d95bc4d

                                                    SHA512

                                                    9e3e4d25f5634e24316f3336ea16b2b2168cdaca6dff72a048df078580cd8b2dbfe32d47127d399bfbbe3e3836ec85dcfabf71b18edc9a603508eb6201bed46a

                                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                    Filesize

                                                    3.0MB

                                                    MD5

                                                    1e6d2bc2a8f03a3e58e5fd6f8801c735

                                                    SHA1

                                                    a763230d956fd8859ddca719e8c864ca776f39bc

                                                    SHA256

                                                    66ef60ac2f2501fc809d002d07831bd9fb87b35eee4c7ef12a43b39b80dd3a53

                                                    SHA512

                                                    a22d1f11712be00853b88e50c994324a76c2c7b9b82750db2a29d46cfb41d2dd50a20858a214b5592b9b543ab024526d5568209a217ec813e5b02357bd475359

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                    Filesize

                                                    442KB

                                                    MD5

                                                    85430baed3398695717b0263807cf97c

                                                    SHA1

                                                    fffbee923cea216f50fce5d54219a188a5100f41

                                                    SHA256

                                                    a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                    SHA512

                                                    06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                    Filesize

                                                    8.0MB

                                                    MD5

                                                    a01c5ecd6108350ae23d2cddf0e77c17

                                                    SHA1

                                                    c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                    SHA256

                                                    345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                    SHA512

                                                    b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

                                                    Filesize

                                                    2KB

                                                    MD5

                                                    6a4a1e8caa9703540faaacb30a2887af

                                                    SHA1

                                                    11c5360225da7c45a24e8c74aed6b270123f6445

                                                    SHA256

                                                    0e9d9477d9e316f0a9be38e2fe3ea687edb1dcf53872b3b39a46d0024f1cf150

                                                    SHA512

                                                    94b7b1c15b00a4c769ec07dc2964f0c8fbf83ae114c0e35ff849290abe22dc0a78e87402cd774c25e1dd8f86673a7b10c36f70c0d60a6efbcb567672cafdc746

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\b7608cf9-37f3-4d83-9fc2-372a5739b127

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    23ebe133c572e637be04412bef4296cf

                                                    SHA1

                                                    9968f73f63393c30817943b2e55255ef53176289

                                                    SHA256

                                                    d0ae9cce63f00a4916251705fade9ab1948daa046b403dfdd4366fb30199e896

                                                    SHA512

                                                    b43668f955edf69bcd85551b4d8dcf673183fe9ccf04a4fd1717fae89dfc013bba11a48989223663b9f7f81105eff68a2fa52c39d44a3ac0f0f882d518246a3c

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\ff9ce90e-e8c7-4133-8db2-430013a398a9

                                                    Filesize

                                                    745B

                                                    MD5

                                                    50a2555b7c3a0614851c37208cef9042

                                                    SHA1

                                                    6bdbda82089963d5b17afaab266c69b23024054e

                                                    SHA256

                                                    f790c40331cbe8c2ba65d08a35f650a7ff5917fe5cfcf1f5ff280f27ebe6698e

                                                    SHA512

                                                    8ca0a15a80049f6df49d8e530b9febd09f0e278bbb0c87dfe60f45ed096650990c35549511579417cdb51d767d60d140a8fbd8d0bd63dcd26be49f2fa5f90bba

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                    Filesize

                                                    997KB

                                                    MD5

                                                    fe3355639648c417e8307c6d051e3e37

                                                    SHA1

                                                    f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                    SHA256

                                                    1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                    SHA512

                                                    8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                    Filesize

                                                    116B

                                                    MD5

                                                    3d33cdc0b3d281e67dd52e14435dd04f

                                                    SHA1

                                                    4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                    SHA256

                                                    f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                    SHA512

                                                    a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                    Filesize

                                                    479B

                                                    MD5

                                                    49ddb419d96dceb9069018535fb2e2fc

                                                    SHA1

                                                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                    SHA256

                                                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                    SHA512

                                                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                    Filesize

                                                    372B

                                                    MD5

                                                    8be33af717bb1b67fbd61c3f4b807e9e

                                                    SHA1

                                                    7cf17656d174d951957ff36810e874a134dd49e0

                                                    SHA256

                                                    e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                    SHA512

                                                    6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                    Filesize

                                                    11.8MB

                                                    MD5

                                                    33bf7b0439480effb9fb212efce87b13

                                                    SHA1

                                                    cee50f2745edc6dc291887b6075ca64d716f495a

                                                    SHA256

                                                    8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                    SHA512

                                                    d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    688bed3676d2104e7f17ae1cd2c59404

                                                    SHA1

                                                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                    SHA256

                                                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                    SHA512

                                                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    937326fead5fd401f6cca9118bd9ade9

                                                    SHA1

                                                    4526a57d4ae14ed29b37632c72aef3c408189d91

                                                    SHA256

                                                    68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                    SHA512

                                                    b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    3c658c86490ed68877ad43391aeb4ef4

                                                    SHA1

                                                    d0582f90db888c5e60ab2de08200a9d06a8a0724

                                                    SHA256

                                                    f2f3d8a74dad96490e51d8dd5f0717b14ae99d08266ad88cf4e026f8d2fba431

                                                    SHA512

                                                    ed5e74ae4107aea7e8c941ac1e3cc96d87a6e8ac1d11902a7943d0a2aee5ea4077e6df433e195e46bd7c1398cdcfe23246e3257680d4e246976df097ec7b2289

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    9e67e24e20e2651f418414b2a27adc2e

                                                    SHA1

                                                    156b891e537cf43196b0395546c84875aaf05fac

                                                    SHA256

                                                    30c20bf0a992927e13b19476f262c356cd1ff41203d0d4a6ea19d7d24c387e6b

                                                    SHA512

                                                    9246ba80ee6fb125efae2c4da0a0f1aa1c6c9a76cf4b1a34fe6f332b3384b4714de65aaf861409f0e821fa431f2c43a56c950b594afacc1f081280377e481b48

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

                                                    Filesize

                                                    7KB

                                                    MD5

                                                    92cf28d3b0a261a160a2ddbc98061352

                                                    SHA1

                                                    2f1cfc350ca467f8a16fc0ebd8f5e2affa4cab4c

                                                    SHA256

                                                    0c4a12d84df3e65c7b80668c2a4c7d6b48c4b36342c12d9c8264240df8fc96eb

                                                    SHA512

                                                    dfa34638f3a096e7fc3fa9631bd0dcddbd594b73e92db00b143c6759b3a0c1c567647ede854ceb48b2d629ff43c85fdda81a26f5f952a981091c8aff34c1b636

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    938134d2daa1f2ae16a6345c60551809

                                                    SHA1

                                                    c3c5b6665fa969abe3d06baecac8c4147c24afad

                                                    SHA256

                                                    89b797c54298c930b3a70be2f8b2b3b6c8aa90d75e3ff51c6069d1155f6f4a5e

                                                    SHA512

                                                    594660cc580c7fff1b1c41eff45bc4e4bd6e8f718f9cc437a562dc66f3c5c83d61ab166bbdc6944d14cbba77f134790232bc3d1b8159263148a2f539e1769819

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\sessionstore-backups\recovery.jsonlz4

                                                    Filesize

                                                    4KB

                                                    MD5

                                                    850358d814b7fd348fe04237d3d16d3e

                                                    SHA1

                                                    2b0a6a0a8dfc21486b7f23bef576e36ca2caeb76

                                                    SHA256

                                                    16d512435c48af74f7bb1cdfd0cf6f22a5a881110f1d55ff97e013e7d8d2c5d4

                                                    SHA512

                                                    3e59ab22f7001afc190c0f5cad357640b3946219581fae388c32366dbfb546c81e41bc27f0d7241a03a6837dbca466edddeaede453a1ba998ecf1c7bdc65685d

                                                  • memory/1088-533-0x0000000001F60000-0x000000000226B000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/1140-547-0x00000000068B0000-0x0000000006BBB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/1140-551-0x00000000009A0000-0x0000000000CAB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/1140-534-0x00000000009A0000-0x0000000000CAB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/1140-549-0x00000000068B0000-0x0000000006BBB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/1592-604-0x0000000000F00000-0x0000000001BD0000-memory.dmp

                                                    Filesize

                                                    12.8MB

                                                  • memory/1592-584-0x0000000000F00000-0x0000000001BD0000-memory.dmp

                                                    Filesize

                                                    12.8MB

                                                  • memory/1592-606-0x0000000000F00000-0x0000000001BD0000-memory.dmp

                                                    Filesize

                                                    12.8MB

                                                  • memory/1868-908-0x0000000000AF0000-0x0000000000D9C000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                  • memory/1868-907-0x0000000000AF0000-0x0000000000D9C000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                  • memory/2356-1-0x0000000077820000-0x0000000077822000-memory.dmp

                                                    Filesize

                                                    8KB

                                                  • memory/2356-242-0x0000000000E40000-0x0000000001339000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2356-2-0x0000000000E41000-0x000000000108A000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                  • memory/2356-307-0x0000000000E40000-0x0000000001339000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2356-275-0x0000000000E41000-0x000000000108A000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                  • memory/2356-509-0x0000000000E40000-0x0000000001339000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2356-0-0x0000000000E40000-0x0000000001339000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2356-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                    Filesize

                                                    972KB

                                                  • memory/2356-536-0x0000000000E40000-0x0000000001339000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2356-537-0x0000000000E41000-0x000000000108A000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                  • memory/2356-3-0x0000000000E40000-0x0000000001339000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2356-276-0x0000000000E40000-0x0000000001339000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2464-609-0x0000000000C00000-0x000000000108E000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2464-603-0x0000000000C00000-0x000000000108E000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2808-567-0x0000000000990000-0x0000000000E38000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2808-589-0x0000000000990000-0x0000000000E38000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2808-587-0x0000000000990000-0x0000000000E38000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2820-590-0x0000000006B50000-0x0000000006FF8000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2820-566-0x0000000006B50000-0x0000000006FF8000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2820-913-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-626-0x0000000006B50000-0x000000000704A000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2820-625-0x0000000006B50000-0x000000000704A000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2820-611-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-792-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-610-0x0000000006B50000-0x0000000006FDE000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2820-811-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-607-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-605-0x0000000006B50000-0x0000000007820000-memory.dmp

                                                    Filesize

                                                    12.8MB

                                                  • memory/2820-859-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-628-0x0000000006B50000-0x000000000704A000-memory.dmp

                                                    Filesize

                                                    5.0MB

                                                  • memory/2820-642-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-602-0x0000000006B50000-0x0000000006FDE000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                  • memory/2820-860-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-629-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-586-0x0000000006B50000-0x0000000006FF8000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2820-630-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-585-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-583-0x0000000006B50000-0x0000000007820000-memory.dmp

                                                    Filesize

                                                    12.8MB

                                                  • memory/2820-582-0x0000000006B50000-0x0000000007820000-memory.dmp

                                                    Filesize

                                                    12.8MB

                                                  • memory/2820-568-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-565-0x0000000006B50000-0x0000000006FF8000-memory.dmp

                                                    Filesize

                                                    4.7MB

                                                  • memory/2820-852-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2820-548-0x00000000010A0000-0x00000000013AB000-memory.dmp

                                                    Filesize

                                                    3.0MB

                                                  • memory/2972-627-0x00000000008C0000-0x0000000000DBA000-memory.dmp

                                                    Filesize

                                                    5.0MB