Overview

overview

10

Static

static

3

660a234458...50.exe

windows7-x64

10

660a234458...50.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    112s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-12-2024 09:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    660a23445819288fb8242b3f167d323a43fe18e5b00527db7524f8a3af4fc150.exe

  • Size

    3.0MB

  • MD5

    03eeb878fcbf55597444d466cf447ee1

  • SHA1

    5c862bb82afb64efb13d25a146970c952916b2aa

  • SHA256

    660a23445819288fb8242b3f167d323a43fe18e5b00527db7524f8a3af4fc150

  • SHA512

    d02b3fcb10898eeaff301daf2fd3ca4549014993079ab3edb135c5c5a6925453d698e14cd151853494efd45a806464f6f4ace846c8a4e3b889adf0ad6c71d24e

  • SSDEEP

    49152:O7SbZvl/c4t4L2agJhXhI759UomVfm8RZsFm:O7SbZvl/c4tRazd9TmVuWZsFm

Score
10/10
amadeygcleanerlummaphemedronestealc9c9aa5stokcredential_accessdiscoveryevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7668600573:AAGyOQm-pttp2w0zypEpPB1GaeAZ5NSmqXk/sendDocument

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

https://atten-supporse.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://drive-connect.cyou/api

https://covery-mover.biz/api

https://atten-supporse.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Phemedrone

    An information and wallet stealer written in C#.

    stealerphemedrone
  • Phemedrone family
    phemedrone
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 15 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\660a23445819288fb8242b3f167d323a43fe18e5b00527db7524f8a3af4fc150.exe
    "C:\Users\Admin\AppData\Local\Temp\660a23445819288fb8242b3f167d323a43fe18e5b00527db7524f8a3af4fc150.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1376
      • C:\Users\Admin\AppData\Local\Temp\1013960001\bTOqFBd.exe
        "C:\Users\Admin\AppData\Local\Temp\1013960001\bTOqFBd.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3568
      • C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe
        "C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe" & rd /s /q "C:\ProgramData\900ZM7Y5XBIM" & exit
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1404
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:4788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1976
          4⤵
          • Program crash
          PID:636
      • C:\Users\Admin\AppData\Local\Temp\1013973001\d44aaff334.exe
        "C:\Users\Admin\AppData\Local\Temp\1013973001\d44aaff334.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Users\Admin\AppData\Local\Temp\1013973001\d44aaff334.exe
          "C:\Users\Admin\AppData\Local\Temp\1013973001\d44aaff334.exe"
          4⤵
          • Executes dropped EXE
          PID:4948
        • C:\Users\Admin\AppData\Local\Temp\1013973001\d44aaff334.exe
          "C:\Users\Admin\AppData\Local\Temp\1013973001\d44aaff334.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2320
      • C:\Users\Admin\AppData\Local\Temp\1013981001\cb5ccd0539.exe
        "C:\Users\Admin\AppData\Local\Temp\1013981001\cb5ccd0539.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2916
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 636
          4⤵
          • Program crash
          PID:4500
      • C:\Users\Admin\AppData\Local\Temp\1013986001\9f64930750.exe
        "C:\Users\Admin\AppData\Local\Temp\1013986001\9f64930750.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:824
      • C:\Users\Admin\AppData\Local\Temp\1013987001\8bd438f1d9.exe
        "C:\Users\Admin\AppData\Local\Temp\1013987001\8bd438f1d9.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4392
      • C:\Users\Admin\AppData\Local\Temp\1013988001\9a7fb42dad.exe
        "C:\Users\Admin\AppData\Local\Temp\1013988001\9a7fb42dad.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4576
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:444
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd0adacc40,0x7ffd0adacc4c,0x7ffd0adacc58
            5⤵
              PID:3792
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,16311845645406037349,4541536834422356577,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1876 /prefetch:2
              5⤵
                PID:2236
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,16311845645406037349,4541536834422356577,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2132 /prefetch:3
                5⤵
                  PID:4260
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,16311845645406037349,4541536834422356577,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2232 /prefetch:8
                  5⤵
                    PID:4324
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,16311845645406037349,4541536834422356577,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:4092
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,16311845645406037349,4541536834422356577,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:4024
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,16311845645406037349,4541536834422356577,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4424 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:3492
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                  4⤵
                  • Uses browser remote debugging
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  PID:6104
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0b5b46f8,0x7ffd0b5b4708,0x7ffd0b5b4718
                    5⤵
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4112
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
                    5⤵
                      PID:5224
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5220
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
                      5⤵
                        PID:5212
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:5356
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:5364
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:6080
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:6088
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                        5⤵
                          PID:1800
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                          5⤵
                            PID:2124
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2984 /prefetch:2
                            5⤵
                              PID:4940
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3752 /prefetch:2
                              5⤵
                                PID:5436
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2752 /prefetch:2
                                5⤵
                                  PID:620
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2128 /prefetch:2
                                  5⤵
                                    PID:6040
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14644573646926001107,5287822253390310593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2744 /prefetch:2
                                    5⤵
                                      PID:3100
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\JJDHIDBFBF.exe"
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5848
                                    • C:\Users\Admin\Documents\JJDHIDBFBF.exe
                                      "C:\Users\Admin\Documents\JJDHIDBFBF.exe"
                                      5⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      PID:384
                                • C:\Users\Admin\AppData\Local\Temp\1013989001\f236e0d249.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1013989001\f236e0d249.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:1232
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM firefox.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2728
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM chrome.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4528
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM msedge.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2352
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM opera.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1952
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /F /IM brave.exe /T
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4112
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                    4⤵
                                      PID:312
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                        5⤵
                                        • Checks processor information in registry
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4964
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8de312d6-e349-4fe2-b1a1-70d5a7150ed8} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" gpu
                                          6⤵
                                            PID:4160
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58c1377f-244c-48da-8c33-3644fab1b51b} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" socket
                                            6⤵
                                              PID:804
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 3248 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0b94186-e6cc-4036-bf76-2e7910e2b667} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                              6⤵
                                                PID:2428
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3720 -childID 2 -isForBrowser -prefsHandle 3744 -prefMapHandle 3740 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bf3a6cf-f60e-4853-9470-b52e06ab42b9} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                                6⤵
                                                  PID:4992
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4352 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4296 -prefMapHandle 4280 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ee8af97-375e-406d-b69c-f7609e90ba5d} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" utility
                                                  6⤵
                                                  • Checks processor information in registry
                                                  PID:5616
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5012 -childID 3 -isForBrowser -prefsHandle 5004 -prefMapHandle 5000 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90f9604e-4c8a-4c01-a777-37fddf95250d} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                                  6⤵
                                                    PID:5932
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5244 -childID 4 -isForBrowser -prefsHandle 5164 -prefMapHandle 5172 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae830d12-7d12-498e-981a-614074a15a61} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                                    6⤵
                                                      PID:5952
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5388 -childID 5 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81f6f2db-4a4c-411b-90ef-5184bffaa1d6} 4964 "\\.\pipe\gecko-crash-server-pipe.4964" tab
                                                      6⤵
                                                        PID:5968
                                                • C:\Users\Admin\AppData\Local\Temp\1013990001\f730d3cf40.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1013990001\f730d3cf40.exe"
                                                  3⤵
                                                  • Modifies Windows Defender Real-time Protection settings
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Windows security modification
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2752
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2060 -ip 2060
                                              1⤵
                                                PID:3904
                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                1⤵
                                                  PID:1584
                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5376
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2916 -ip 2916
                                                  1⤵
                                                    PID:3612
                                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    1⤵
                                                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                    • Checks BIOS information in registry
                                                    • Executes dropped EXE
                                                    • Identifies Wine through registry keys
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:6108

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Modify Authentication Process

                                                  1
                                                  T1556

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Defense Evasion

                                                  Impair Defenses

                                                  2
                                                  T1562

                                                  Disable or Modify Tools

                                                  2
                                                  T1562.001

                                                  Modify Authentication Process

                                                  1
                                                  T1556

                                                  Modify Registry

                                                  3
                                                  T1112

                                                  Virtualization/Sandbox Evasion

                                                  2
                                                  T1497

                                                  Credential Access

                                                  Credentials from Password Stores

                                                  1
                                                  T1555

                                                  Credentials from Web Browsers

                                                  1
                                                  T1555.003

                                                  Modify Authentication Process

                                                  1
                                                  T1556

                                                  Steal Web Session Cookie

                                                  1
                                                  T1539

                                                  Unsecured Credentials

                                                  4
                                                  T1552

                                                  Credentials In Files

                                                  4
                                                  T1552.001

                                                  Discovery

                                                  Browser Information Discovery

                                                  1
                                                  T1217

                                                  Query Registry

                                                  8
                                                  T1012

                                                  System Information Discovery

                                                  5
                                                  T1082

                                                  System Location Discovery

                                                  1
                                                  T1614

                                                  System Language Discovery

                                                  1
                                                  T1614.001

                                                  Virtualization/Sandbox Evasion

                                                  2
                                                  T1497

                                                  Lateral Movement

                                                  Collection

                                                  Data from Local System

                                                  3
                                                  T1005

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\ProgramData\IDAAKEHJDHJKEBFHJEGD
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    2480e998393ba150d90de72217f545e8

                                                    SHA1

                                                    42863623b2330cf085447e3be155e16808d6f927

                                                    SHA256

                                                    e352ddb666bd4527ec99af5791e8adc288cccacbc588f6e36c32651732839333

                                                    SHA512

                                                    5cd930009086b8d1e5cd912ec41c42d16464c12c2760ba82874cfcb48e0b9c448c298c6eef06b1137e40a772f5e2b465e13cf1a88cea316cfe92459a9b064b9b

                                                    Download Submit

                                                  • C:\ProgramData\mozglue.dll
                                                    Filesize

                                                    593KB

                                                    MD5

                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                    SHA1

                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                    SHA256

                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                    SHA512

                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                    Download Submit

                                                  • C:\ProgramData\nss3.dll
                                                    Filesize

                                                    2.0MB

                                                    MD5

                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                    SHA1

                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                    SHA256

                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                    SHA512

                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    Filesize

                                                    2B

                                                    MD5

                                                    d751713988987e9331980363e24189ce

                                                    SHA1

                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                    SHA256

                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                    SHA512

                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                    Filesize

                                                    954B

                                                    MD5

                                                    405872e887f416c6e1ad655fd65465c9

                                                    SHA1

                                                    4d0fab5fadc52ec4ef74a26c8672f74682ef5476

                                                    SHA256

                                                    0360ef65823b75c9982c9e5527d080aaeede328d664a06a23c9b7cf5b0106d4a

                                                    SHA512

                                                    b5aa1608c507fc42fa9d2be48745083e0ebc72d5903765c7a2f953c978e7d9313b3778fd0c55340e07c2fe0afa39dc7b979fa64ddbf13684c22bd119d6bf6baa

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\6f8163ec-088e-4955-a0d0-9aeab1af56e7.dmp
                                                    Filesize

                                                    830KB

                                                    MD5

                                                    e474a694da864a15f1687c3e7ab64840

                                                    SHA1

                                                    6403b49b86af1e4d8b26ef33ee3c3bf4865ed924

                                                    SHA256

                                                    2c8d2d451019f5875ee1b3598a4badb313f4c604538f86eef1b7b08be8248372

                                                    SHA512

                                                    1f502d79966cea1999de4359d5218397c3b1441e081e51f131ec016340a0e8bcc69f2f6cbf892b6db2d04ef756acd80d0b9fa8e03a5754f772474f94f9580cab

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\72f7783f-44b7-48d7-a325-6bf9c5da7a0b.dmp
                                                    Filesize

                                                    838KB

                                                    MD5

                                                    ebefb8e98f73cd091c0c0effee4f0e4e

                                                    SHA1

                                                    9300daa5e91b144c4a2d3293bd1bdf2e6d91e52d

                                                    SHA256

                                                    3a02d7c5f4390b27fcf0eb52ec12bd094ee66895d56e954b790d200889f09d08

                                                    SHA512

                                                    e7a51ffb1c304ce780c06542c24248567b471e2614490c973d8281e654777eeecf67eca4a8a9fc03dfd23ffe552ffce3f384d8b852575770465f6fdfeeb84457

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7667fd68-d08f-4a5b-b208-87ded14cf894.dmp
                                                    Filesize

                                                    838KB

                                                    MD5

                                                    ef4ce5cfdac08e0e2ba19f2e1f70c796

                                                    SHA1

                                                    51f7d5cc38d03dab30d651847d5a71eb76f8f43b

                                                    SHA256

                                                    240f6cb3bd6eddadf094c20ee65286994fb0969c440af17bad13b5fca76a4bd3

                                                    SHA512

                                                    93c3fd495428a74f4e1670c92b52a154fed1a5039c9d046df2ea988dc2bceab094953af4b0cd9ff7cbe1c85e2970a5fcd8510261608e8478d84905ad86111263

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7668175d-5dd2-43fe-9f6d-e2bedbc4b269.dmp
                                                    Filesize

                                                    826KB

                                                    MD5

                                                    d70b3eee192c300647fe1566ef81f219

                                                    SHA1

                                                    2487a3e7839fcbbc283533e505930752c2fb53fa

                                                    SHA256

                                                    e2ebc0268e136c84db3a65b19b4e6ed900292a6350a3348863a48c0bf76929e3

                                                    SHA512

                                                    67f09b2749efff51a973dd9c6bf8fa2f1d4a3e7514f5883bf7dc9ee5cba14697bea8112826ce64518d00384d69e07f0103b1b39074c57137aae88fdce2d41be2

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\aed1d8af-8c08-4268-84e6-a11b186067e5.dmp
                                                    Filesize

                                                    838KB

                                                    MD5

                                                    dbc277302e954de714a256d3ef63fc8b

                                                    SHA1

                                                    7e6f6d2890bd978442bff2a7f1db858fd7a33900

                                                    SHA256

                                                    f041bfbea107862d208be3cc31fd733bc4eb4d51a084d46d769e734ecdc3345e

                                                    SHA512

                                                    cdf3d948702c4a1d732578d4dc13f59ab88eaf1ce9bacfc1076611b6f8f94838bb558db61cc58ab4f134b287ef92001c75fc22656078a4a43b46c160595216c7

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b3749824-9f0a-4c18-87cc-cfd06b5a96f5.dmp
                                                    Filesize

                                                    830KB

                                                    MD5

                                                    cc6643bb4c4be19dcc969cf7d8d829d5

                                                    SHA1

                                                    fe2a9933ed232ee6cb7676aa1e764a970b767f3c

                                                    SHA256

                                                    b615ad802551de75d933610a7fabf088d5089698352a72f4e6df08a476130c67

                                                    SHA512

                                                    5ba2cc4435b11c4cb9f4c6258e59e489eccf0b4860814719c20d9ba0489e3a950fff9bf28b4f28f9a73206742b7f84a5a7b2ac08b1179392a854fafe24253860

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b7c5b23a-b0bd-4588-afa1-89c1dd2e3dfd.dmp
                                                    Filesize

                                                    826KB

                                                    MD5

                                                    64c91fc24b5ed80bcbd8f571deffcde9

                                                    SHA1

                                                    193e3444d44e0e6824cd1ae729d1256db34035f8

                                                    SHA256

                                                    be2f3a83a19b4da60ce4aa3619976ef4a2aabb56e0abd3fb996edaaaccf45df6

                                                    SHA512

                                                    6d966a83849df221b2afb9c39d09961b1344b186791ee96a035c37a5581d8c749f5c8596c48d7e25e822771a04a5bc05ae3597e1fd47831a879c29908c06a5d0

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    e443ee4336fcf13c698b8ab5f3c173d0

                                                    SHA1

                                                    9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

                                                    SHA256

                                                    79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

                                                    SHA512

                                                    cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    56a4f78e21616a6e19da57228569489b

                                                    SHA1

                                                    21bfabbfc294d5f2aa1da825c5590d760483bc76

                                                    SHA256

                                                    d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

                                                    SHA512

                                                    c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    9b4c709810f2608b77ff9d9175784553

                                                    SHA1

                                                    21e1e536271027b02b6c58aaba2fa82a90d035a6

                                                    SHA256

                                                    af14b8be6de51248a2a6ebd87de4581b46c9fa055719129d1c6af2e127a3e0a6

                                                    SHA512

                                                    3babfb9b005658a6a3365bd9c94d71556f7a72a96559e515d7c0e4969902a1c3c6b73275826a52f17c9b3edcc314b5c71f9d0030539a9c2528b72d27edc591fa

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    152B

                                                    MD5

                                                    e9215be76fb06ebb82349dcefd3b985b

                                                    SHA1

                                                    26ac2c55875289f3a32259261aaa18eefecdb55f

                                                    SHA256

                                                    f4074e8bd625ca225ff634314174b82ed1fe3eb785d4284758e352493807e3fe

                                                    SHA512

                                                    0ce709b7d416aab9275f29cda3f6c023c42a46eeb8cfcc79883a49dd5dddcae64e8af00748682763fe3bf0228aa5578b34a54394b31c920d280458dcf7f8e6eb

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    Filesize

                                                    5KB

                                                    MD5

                                                    e61e9bacd574174a8d8a543606faa44a

                                                    SHA1

                                                    d92d144ecc09025f060c799ff2ea46168875b707

                                                    SHA256

                                                    29e05f37ffac5a9a4b5de0eeb824fc884cdbe52efc07ccc3c5e21124340055e6

                                                    SHA512

                                                    e74cb35642b2094753d9af9cb83e482c82590e2e318e6d4b577fb4a9d5e4421f53013701ffcd85e19af0b314ba177b4cd8b805cf3b25650f1691d28c4c10b436

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                    Filesize

                                                    264KB

                                                    MD5

                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                    SHA1

                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                    SHA256

                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                    SHA512

                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HOI3BGS3\download[1].htm
                                                    Filesize

                                                    1B

                                                    MD5

                                                    cfcd208495d565ef66e7dff9f98764da

                                                    SHA1

                                                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                    SHA256

                                                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                    SHA512

                                                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json
                                                    Filesize

                                                    22KB

                                                    MD5

                                                    4bd61260e41f4d0d3f8c3dcfa8094dd8

                                                    SHA1

                                                    0bd5bc911f064f3d9e9a81826ff8c4270d5458c6

                                                    SHA256

                                                    2788bdf66dae9d6ab11fbf73728b4215aaee2114209480a060d715d99c3c6cfa

                                                    SHA512

                                                    662fe7b6bfbd6518a39d02d0358338ef71c3ef0adcded507d2b6b631b0491ccf312896d622eed560558c0bdc389c9aeaac651e1f4bddcf9cafcb67c73c63f158

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                                                    Filesize

                                                    13KB

                                                    MD5

                                                    53f402668af654461c303c71067ba975

                                                    SHA1

                                                    0cfc516cfd28f322e0597c60c7ab74bd5e3463a9

                                                    SHA256

                                                    48be4a153952cad1c7e06761e64f43a21e61b734b3ac1da3edb12ea057342f53

                                                    SHA512

                                                    1e92cadb72ff6856bdcc44476d2828ba8d0b105644aae8df95b3e43e89f826221156dc072e09a25b36dd32e67fe291cb4e69a66e1b731d2f5c22b9aecf8ac098

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    96c542dec016d9ec1ecc4dddfcbaac66

                                                    SHA1

                                                    6199f7648bb744efa58acf7b96fee85d938389e4

                                                    SHA256

                                                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                    SHA512

                                                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe
                                                    Filesize

                                                    612B

                                                    MD5

                                                    e3eb0a1df437f3f97a64aca5952c8ea0

                                                    SHA1

                                                    7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

                                                    SHA256

                                                    38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

                                                    SHA512

                                                    43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013960001\bTOqFBd.exe
                                                    Filesize

                                                    116KB

                                                    MD5

                                                    15df154033a71bc220fef7a9bb865320

                                                    SHA1

                                                    1d4e67c387e66510d42063dcb92a8fa2b0f3500d

                                                    SHA256

                                                    3fa668ec3d4494088ac6c1fdfbe8ed31a7c1c66ba049260798654a1b21b0377d

                                                    SHA512

                                                    e74e7b1ee12ed2c6f10ecc1284c1b060d92b639fec108e88ce3a1e92bef2c78099636af26fbb5916c74e2026d32f9a69811adae7729b16a97a5a7485086afa51

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013967001\jd5fvXs.exe
                                                    Filesize

                                                    382KB

                                                    MD5

                                                    83b8507f0961cc5fd4a39d1def4dad1c

                                                    SHA1

                                                    7f97044ffbc10454d94fc6db868ae4071f7a5d46

                                                    SHA256

                                                    d8405be5cc0b5273433b62e2af31c18fa688fd5f0d2e11f8ff41a064fa917a09

                                                    SHA512

                                                    f5c65cd2590f971e2076b7687e60253ae333b85a882ad089fa3a097fdf9bbab9e359b4f2b6e0f18f36fd64dc905a89aca41a15b82752c8a4357f121f331e99f9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013973001\d44aaff334.exe
                                                    Filesize

                                                    710KB

                                                    MD5

                                                    28e568616a7b792cac1726deb77d9039

                                                    SHA1

                                                    39890a418fb391b823ed5084533e2e24dff021e1

                                                    SHA256

                                                    9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                                                    SHA512

                                                    85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013981001\cb5ccd0539.exe
                                                    Filesize

                                                    1.9MB

                                                    MD5

                                                    d94f74616ef91f0e61e6b86113f00d86

                                                    SHA1

                                                    3da258fb737dace11a3514bf96ca8234f620b9a2

                                                    SHA256

                                                    31ffd14429e3f64e8e58d21173ee37bb635208f28984685d9bb62e09c9bdba5f

                                                    SHA512

                                                    45bacb8e7f40192cccf03fe1cebdc63f5c9e195f9c0894307687ba8f94cbff729a35ad5f73a42b0274b3a9a04498b7a96770829a80b28f20cddfbb81395c92d8

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013986001\9f64930750.exe
                                                    Filesize

                                                    2.5MB

                                                    MD5

                                                    2a78ce9f3872f5e591d643459cabe476

                                                    SHA1

                                                    9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                                                    SHA256

                                                    21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                                                    SHA512

                                                    03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013987001\8bd438f1d9.exe
                                                    Filesize

                                                    1.8MB

                                                    MD5

                                                    0e86acebd9410f1680d96d392364e5a4

                                                    SHA1

                                                    ea6d2e3b10bc1713ff88aafda612bdb0eec45c0e

                                                    SHA256

                                                    ce7d115d04674defaea3fdf2edc1025dbd1ccec29d787b43eb648a0fa04b2380

                                                    SHA512

                                                    ac06c4e07a1ecaad2a1e18efc85c642b56d8ac573bad843f0cafc3b41f2ffc46e31b4df817efa004c2b8dca059a9c9feac916a0fa216b5af122423218f95b166

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013988001\9a7fb42dad.exe
                                                    Filesize

                                                    1.7MB

                                                    MD5

                                                    91b4c5062199f39ceb87526df170dd54

                                                    SHA1

                                                    472ca913d330d87b9a3e31ef19cd17ee9951288f

                                                    SHA256

                                                    d53868d13bf27fd6fde4e6cc2040d0fa1785cd60abf244316cdd076af2c77ad4

                                                    SHA512

                                                    57c55ad998b26129cf56d02d9e97ddea17520eb1499b4628e56cb14ab1d56683562bdc37ae5d214380bb22b179cfb486f9296c88836b92781d9c3099d3455107

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013989001\f236e0d249.exe
                                                    Filesize

                                                    948KB

                                                    MD5

                                                    dc4fe278cc5635389e1aaeeb3ef643db

                                                    SHA1

                                                    65e534bb7e8d37ddb21beea2074c734154b4a3e9

                                                    SHA256

                                                    5b7b691860005dbd5f7bc7f4fadc45bad6bb80aba9a609338867baa0cd0591a9

                                                    SHA512

                                                    b79fc0114c2e0e648654b65ddfafc4c42171235abc02d7611877a675f044e544a14bcabf616ce2d8d332b43a97a5d4f41d7f38378b76e3e44d333c1d86da95b5

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\1013990001\f730d3cf40.exe
                                                    Filesize

                                                    2.7MB

                                                    MD5

                                                    9a3526b9a7033cc280a3c4401b403df6

                                                    SHA1

                                                    9678ad70e01a2d8a0cb9358344ab2b77f05ca334

                                                    SHA256

                                                    9a4b4702cffe958ae572c42f5b0abe6700201467886090b7059bb8c32d1c3693

                                                    SHA512

                                                    fde094fc32c4fe1b3fed4bff7808777062573b732b39da55639fb0673467e1b8fd46f70050711154c13f1f85fc21a5eb6e14dbd4e25f795d7ffa8ebbe9d7a92b

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                    Filesize

                                                    3.0MB

                                                    MD5

                                                    03eeb878fcbf55597444d466cf447ee1

                                                    SHA1

                                                    5c862bb82afb64efb13d25a146970c952916b2aa

                                                    SHA256

                                                    660a23445819288fb8242b3f167d323a43fe18e5b00527db7524f8a3af4fc150

                                                    SHA512

                                                    d02b3fcb10898eeaff301daf2fd3ca4549014993079ab3edb135c5c5a6925453d698e14cd151853494efd45a806464f6f4ace846c8a4e3b889adf0ad6c71d24e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                    Filesize

                                                    479KB

                                                    MD5

                                                    09372174e83dbbf696ee732fd2e875bb

                                                    SHA1

                                                    ba360186ba650a769f9303f48b7200fb5eaccee1

                                                    SHA256

                                                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                    SHA512

                                                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                    Filesize

                                                    13.8MB

                                                    MD5

                                                    0a8747a2ac9ac08ae9508f36c6d75692

                                                    SHA1

                                                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                    SHA256

                                                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                    SHA512

                                                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                                                    Filesize

                                                    6KB

                                                    MD5

                                                    b483b1e751f27336ea766a693f706495

                                                    SHA1

                                                    73f67f694e51b9c387d733f8adcc6ae74ea4f642

                                                    SHA256

                                                    76482e213d95d40a99fa7577d10e103929a60abef22125c21ed778e30573b48d

                                                    SHA512

                                                    3261618595be6c0a2b5e8979a4672a79e6957e31ee0651f4d4582625c80f9dc304387b2220496e39abcdc0c75b2525b10c597833fcaca09d6265fff730374336

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    45539482e4184a12c62c6640b37f087c

                                                    SHA1

                                                    f80fc8e1d0c3ac798359fc4c8beefb50be259af9

                                                    SHA256

                                                    a06138c2e5dcc9da7fd07784d2269905e924a4905c2b42aaf3c430f6b24224c3

                                                    SHA512

                                                    02a57ca92e4abf8f0e44f329dc43a0963cf19e635c127c156b008c1c8a6b5072a9302ad032f06ddf9922e5e5ff60c2a73aa8a1070f43a3c57379b7f903d7e138

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cookies.sqlite-wal
                                                    Filesize

                                                    256KB

                                                    MD5

                                                    29f8e903307b8c22b9cde791b43c77d6

                                                    SHA1

                                                    d4792b19dd7c4b7bab3095815f4a26bddac8f87e

                                                    SHA256

                                                    4490602d5aa62d6b9ce4b0d53a8a0afd89bae9037f3911e07dd33a4009131c14

                                                    SHA512

                                                    6e3b3e1f32daab6a5105ffe4ded65c075b72c9a2bb9cafaf2881a71fd0c036251b5a70bfa22b0bc60ee6a2e83683da41ebb7be7f781a056eff1136f541baf970

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    5KB

                                                    MD5

                                                    0d479a16539c81827d3b116459e89e98

                                                    SHA1

                                                    19b4f9338ba1fdfaf893c2eb2359e8bacdcafaa7

                                                    SHA256

                                                    b19de17362e47f8a593812f57518a39e77899216d8bdbf9e464cc4d67a00207e

                                                    SHA512

                                                    4c89b9d36d8e5f6b9bf57bb5a9bccfd2166a716493da29e2a9617d9e3d1ee5e91cef1e58a421f1c98bb9eb11b58740d65dfa19fa9e8211fa14e837933a114c34

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    b22d259bebff96bc9348d47d7c75a18b

                                                    SHA1

                                                    e1173f704bc5f23bb1a2f7cebbc9353de13edc9b

                                                    SHA256

                                                    a2267bb17285982571d0873230295bf8b2a049304a7232246a892eabee2b9330

                                                    SHA512

                                                    c0fe8e6619af1e822d17d0722cab61b74e95e9553ea72f1287c65b3ad57ca2854a070bc4ffa00df773d89965295220404148c0af6c704091a357a3e34d884515

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    6KB

                                                    MD5

                                                    bd87010bbedb083d937e5c5450877028

                                                    SHA1

                                                    528e57d5d2f84b832d0e663935893e55efc54682

                                                    SHA256

                                                    9b00538d6b813cd1ff2b8a0f31c5f369a8017fc5b3d731b8f60205c9a566251d

                                                    SHA512

                                                    4ed0ea31ad8060be7ba11638875bb8c3061b41d707ded25cb7fe96015e734433343c5b2af3e0353139a34dcd76f0bf55688b8f288bf4aa69c7e5c4aa27963515

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    3e425c5440ee9f883a7e149832ea4d09

                                                    SHA1

                                                    6851de1b071cee1ce68c8b92eabb221abdd34a50

                                                    SHA256

                                                    a9d8602b22f2df1276f58a2556e507704906572406f8eda80dee11bd8487914d

                                                    SHA512

                                                    484bbbdec2a473e6949b9c105a7e4a85e988b4c8e2d5535f0e9fe6de800472dd161372e759e74b2f74f4ff057ef46aadf3266597785f3e3f26159b2a313087a6

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\6b944601-bf21-45c8-aa24-a3bfc10f7c8e
                                                    Filesize

                                                    982B

                                                    MD5

                                                    71e3822e70fc4ba416755d1e66c839dd

                                                    SHA1

                                                    39cc671c3ceaa7a08108f18b195bbf265f340105

                                                    SHA256

                                                    6f71b30503973d3cd9341148448e745deb2010351e8e8d6d12248289a116ad62

                                                    SHA512

                                                    ea007f0f30548e8f676ce9cffc305b4089265c51468e210d89b4a6186d32459a4f87de0ae4a625ac8607f9a8eea208720b9e3c4d2ecc220da464c804d17b3655

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\a02828a7-190f-4606-9253-2267190d592e
                                                    Filesize

                                                    671B

                                                    MD5

                                                    643195444ed084235c41c44e337a86f9

                                                    SHA1

                                                    ef70d51ca4af36c4d7db9db0e386576c1a860290

                                                    SHA256

                                                    a94194e052011c856ec4b9bcd6387d8d79b1613230457a52dd5d5ffa796b74b8

                                                    SHA512

                                                    9342bb996da3a890e032a3420017c12595df4f625570604971c8f48b5eab6ad164023a7adcd7a02e91f7f169b5256dab8508942c4a10760658816104ab3329f0

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\c7511c80-c2eb-4814-842b-62dae23836e0
                                                    Filesize

                                                    24KB

                                                    MD5

                                                    dbffdf933c4c3572ac1de6ba18e12e4d

                                                    SHA1

                                                    0551834f3245c8600a9e7b2cf42dbf6ecdecb50a

                                                    SHA256

                                                    1d0c8ccadcf608a8557fae94ec9e8ed84d84c5d4d78da8645e4066a110340b03

                                                    SHA512

                                                    03728e32b9b6d30d46a2df8f1470e9c52753132dfcf700cd309db0b3a9635886fb7af0c74122a718e8a39d5a621ff0947139a84d7e6fecacdd28462e7f115141

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                                    Filesize

                                                    1.1MB

                                                    MD5

                                                    842039753bf41fa5e11b3a1383061a87

                                                    SHA1

                                                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                    SHA256

                                                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                    SHA512

                                                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                                    Filesize

                                                    116B

                                                    MD5

                                                    2a461e9eb87fd1955cea740a3444ee7a

                                                    SHA1

                                                    b10755914c713f5a4677494dbe8a686ed458c3c5

                                                    SHA256

                                                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                    SHA512

                                                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                                    Filesize

                                                    372B

                                                    MD5

                                                    bf957ad58b55f64219ab3f793e374316

                                                    SHA1

                                                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                    SHA256

                                                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                    SHA512

                                                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                                    Filesize

                                                    17.8MB

                                                    MD5

                                                    daf7ef3acccab478aaa7d6dc1c60f865

                                                    SHA1

                                                    f8246162b97ce4a945feced27b6ea114366ff2ad

                                                    SHA256

                                                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                    SHA512

                                                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\places.sqlite-wal
                                                    Filesize

                                                    1.4MB

                                                    MD5

                                                    2fac77046886557e516d6d6bb0700f87

                                                    SHA1

                                                    c4a5f3c4891bbb375cd1dc335cb4b219cef52ebb

                                                    SHA256

                                                    24f64ab71b5a75e5e41dcb39d75a705481b9735e6dd3c28e551a92c8a5558847

                                                    SHA512

                                                    06812ed38e7d21f79328cacf834b86295ec138bf9f89ee0b42eeffe8252b9a920ec5d1081cdd603ed793dd8f58a5780fa6feb6581ecc2f5b6abc67eb5459ca5d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    c838ea8bc712f7bca2f14f30f37a8f81

                                                    SHA1

                                                    ceb1198536e68258c71f04eec72e6deeaf9a466d

                                                    SHA256

                                                    d1ecf8dae51e00f2d86bab0a9508d2820e5be3b977e22b9bcbe582bec6b7c5fe

                                                    SHA512

                                                    3fb1a00f08e8d64e76d6678d758ceedd5b6dd2f4815e74c3474af220fd838b4cacf1ba7c9326f4b27e952d1cf0e3f99f8a35c0e28a1a0de7f1c79c970037b211

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    2f5df6682748339713ad09376012ed83

                                                    SHA1

                                                    4c53371a7358cbdd38df23857579ea1bb00e1630

                                                    SHA256

                                                    08b6a6fff4f91746bb147970db49e7726a621e6bd48836679077f1858e809305

                                                    SHA512

                                                    144916241c2a88061f2eae8435aa2a70f6831f9c5cb473f7b33c90af419f7832644817c67681d62f24867b0a462312d9de1286bf8e445c74af57f82197d9f30d

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    8fd64837794cf020a8dd262b89f4bbff

                                                    SHA1

                                                    9448eeac0c177c73221c82b15e26d58bfedfe19a

                                                    SHA256

                                                    5778ba01f0d17da118af5fe2878b0a95f3d88f13894e37b7b0bd2c7fef4b780a

                                                    SHA512

                                                    5139c2fbe1f3424ab4363fd4ffeb576ed5c9e42f49249984c048905555da0df24a289004a3ae8a7b9d6e5add0d79e794575e22175f4b81807aa7a48c388dba1e

                                                    Download Submit

                                                  • C:\Users\Admin\Documents\JJDHIDBFBF.exe
                                                    Filesize

                                                    3.1MB

                                                    MD5

                                                    f6e2b6d16fd443be0ac4367ed066962d

                                                    SHA1

                                                    c6458aeb577c363fb56889ed6116c4f50126b8f9

                                                    SHA256

                                                    5f9e40725563f5d19fe7e06ede1e717ac26a7105c3533b7404fb8611e11847d4

                                                    SHA512

                                                    d76ecf20f6e04e2cea5acd5b910d1d75d180f3623cf2625b228854657a71e60c84d14fe95a16c6a6b6736c2bb0afd119361f0c6cf06da7a576713546feb7b79a

                                                    Download Submit

                                                  • memory/384-1151-0x0000000000A10000-0x0000000000D29000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/384-1165-0x0000000000A10000-0x0000000000D29000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/824-689-0x0000000000B00000-0x0000000000B57000-memory.dmp

                                                    Filesize

                                                    348KB

                                                    Download

                                                  • memory/1240-0-0x0000000000910000-0x0000000000C1E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1240-16-0x0000000000910000-0x0000000000C1E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1240-1-0x0000000077644000-0x0000000077646000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/1240-2-0x0000000000911000-0x0000000000979000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/1240-3-0x0000000000910000-0x0000000000C1E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1240-4-0x0000000000910000-0x0000000000C1E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1240-17-0x0000000000911000-0x0000000000979000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/1376-145-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-3628-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-204-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-2511-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-1229-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-3638-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-70-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-69-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-53-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-52-0x0000000000B61000-0x0000000000BC9000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/1376-3625-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-3636-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-31-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-22-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-20-0x0000000000B61000-0x0000000000BC9000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/1376-21-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-634-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-1043-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/1376-18-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/2060-105-0x0000000000400000-0x000000000064B000-memory.dmp

                                                    Filesize

                                                    2.3MB

                                                    Download

                                                  • memory/2320-94-0x0000000000400000-0x0000000000457000-memory.dmp

                                                    Filesize

                                                    348KB

                                                    Download

                                                  • memory/2320-96-0x0000000000400000-0x0000000000457000-memory.dmp

                                                    Filesize

                                                    348KB

                                                    Download

                                                  • memory/2752-263-0x0000000000C60000-0x0000000000F16000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2752-262-0x0000000000C60000-0x0000000000F16000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2752-699-0x0000000000C60000-0x0000000000F16000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2752-684-0x0000000000C60000-0x0000000000F16000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2752-261-0x0000000000C60000-0x0000000000F16000-memory.dmp

                                                    Filesize

                                                    2.7MB

                                                    Download

                                                  • memory/2916-270-0x0000000000400000-0x0000000000C73000-memory.dmp

                                                    Filesize

                                                    8.4MB

                                                    Download

                                                  • memory/2916-166-0x0000000000400000-0x0000000000C73000-memory.dmp

                                                    Filesize

                                                    8.4MB

                                                    Download

                                                  • memory/2916-129-0x0000000010000000-0x000000001001C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                    Download

                                                  • memory/2916-168-0x0000000000400000-0x0000000000C73000-memory.dmp

                                                    Filesize

                                                    8.4MB

                                                    Download

                                                  • memory/2916-706-0x0000000000400000-0x0000000000C73000-memory.dmp

                                                    Filesize

                                                    8.4MB

                                                    Download

                                                  • memory/2916-703-0x0000000000400000-0x0000000000C73000-memory.dmp

                                                    Filesize

                                                    8.4MB

                                                    Download

                                                  • memory/2916-116-0x0000000000400000-0x0000000000C73000-memory.dmp

                                                    Filesize

                                                    8.4MB

                                                    Download

                                                  • memory/3568-50-0x00007FFD0A503000-0x00007FFD0A505000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/3568-51-0x0000000000580000-0x00000000005A4000-memory.dmp

                                                    Filesize

                                                    144KB

                                                    Download

                                                  • memory/4392-161-0x0000000000DB0000-0x0000000001240000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/4392-165-0x0000000000DB0000-0x0000000001240000-memory.dmp

                                                    Filesize

                                                    4.6MB

                                                    Download

                                                  • memory/4576-471-0x0000000000590000-0x0000000000C22000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/4576-184-0x0000000000590000-0x0000000000C22000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/4576-205-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                    Filesize

                                                    972KB

                                                    Download

                                                  • memory/4576-1171-0x0000000000590000-0x0000000000C22000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/4576-1095-0x0000000000590000-0x0000000000C22000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/4576-707-0x0000000000590000-0x0000000000C22000-memory.dmp

                                                    Filesize

                                                    6.6MB

                                                    Download

                                                  • memory/5376-617-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download

                                                  • memory/6108-3635-0x0000000000B60000-0x0000000000E6E000-memory.dmp

                                                    Filesize

                                                    3.1MB

                                                    Download