lumma | 3bdc57e936012fc092277a2e3d719e4ef00d476198f13d1fff180b6c49f81a6d

Analysis

max time kernel
404s
max time network
404s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-fr
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-frlocale:fr-fros:windows10-ltsc 2021-x64systemwindows
submitted
02-01-2025 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

70.0MB
MD5

f12e87197e19cb59d8495f03cac277b2
SHA1

34eb2318335988399bc25702a0d557f8c3101f11
SHA256

3bdc57e936012fc092277a2e3d719e4ef00d476198f13d1fff180b6c49f81a6d
SHA512

eecbecbd873e24221ca28dfbbb9edb5b33853c5790e7ec8342e19e969f0077d9d2528a7c13b4e9f4e0b4386508a9efcc95fb9ff1d4744f45f84141f2838f2b68
SSDEEP

24576:cv29nUaE0Nkgh3hiC3zfJhS+bQfn+pVqo7VaLGL/23ry:ywnUCdhx9c/+pVlhaiCu

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 1 IoCs

pid	Process
4496	Sites.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1040	tasklist.exe
3512	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SavageStrategy	Setup.exe
File opened for modification	C:\Windows\PurpleConstraint	Setup.exe
File opened for modification	C:\Windows\DrumSleeve	Setup.exe
File opened for modification	C:\Windows\GreaterMuslims	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sites.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "3"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4496	Sites.com
4496	Sites.com
4496	Sites.com
4496	Sites.com
4496	Sites.com
4496	Sites.com
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1936	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	3512	tasklist.exe
Token: SeDebugPrivilege	1936	taskmgr.exe
Token: SeSystemProfilePrivilege	1936	taskmgr.exe
Token: SeCreateGlobalPrivilege	1936	taskmgr.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe
Token: SeDebugPrivilege	2388	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4496	Sites.com
4496	Sites.com
4496	Sites.com
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4496	Sites.com
4496	Sites.com
4496	Sites.com
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe
1936	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 3680	3624	Setup.exe	83
PID 3624 wrote to memory of 3680	3624	Setup.exe	83
PID 3624 wrote to memory of 3680	3624	Setup.exe	83
PID 3680 wrote to memory of 1040	3680	cmd.exe	85
PID 3680 wrote to memory of 1040	3680	cmd.exe	85
PID 3680 wrote to memory of 1040	3680	cmd.exe	85
PID 3680 wrote to memory of 1804	3680	cmd.exe	86
PID 3680 wrote to memory of 1804	3680	cmd.exe	86
PID 3680 wrote to memory of 1804	3680	cmd.exe	86
PID 3680 wrote to memory of 3512	3680	cmd.exe	88
PID 3680 wrote to memory of 3512	3680	cmd.exe	88
PID 3680 wrote to memory of 3512	3680	cmd.exe	88
PID 3680 wrote to memory of 400	3680	cmd.exe	89
PID 3680 wrote to memory of 400	3680	cmd.exe	89
PID 3680 wrote to memory of 400	3680	cmd.exe	89
PID 3680 wrote to memory of 3996	3680	cmd.exe	90
PID 3680 wrote to memory of 3996	3680	cmd.exe	90
PID 3680 wrote to memory of 3996	3680	cmd.exe	90
PID 3680 wrote to memory of 4996	3680	cmd.exe	91
PID 3680 wrote to memory of 4996	3680	cmd.exe	91
PID 3680 wrote to memory of 4996	3680	cmd.exe	91
PID 3680 wrote to memory of 1032	3680	cmd.exe	92
PID 3680 wrote to memory of 1032	3680	cmd.exe	92
PID 3680 wrote to memory of 1032	3680	cmd.exe	92
PID 3680 wrote to memory of 3356	3680	cmd.exe	93
PID 3680 wrote to memory of 3356	3680	cmd.exe	93
PID 3680 wrote to memory of 3356	3680	cmd.exe	93
PID 3680 wrote to memory of 4524	3680	cmd.exe	94
PID 3680 wrote to memory of 4524	3680	cmd.exe	94
PID 3680 wrote to memory of 4524	3680	cmd.exe	94
PID 3680 wrote to memory of 4496	3680	cmd.exe	95
PID 3680 wrote to memory of 4496	3680	cmd.exe	95
PID 3680 wrote to memory of 4496	3680	cmd.exe	95
PID 3680 wrote to memory of 4964	3680	cmd.exe	96
PID 3680 wrote to memory of 4964	3680	cmd.exe	96
PID 3680 wrote to memory of 4964	3680	cmd.exe	96
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2244 wrote to memory of 2388	2244	firefox.exe	112
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113
PID 2388 wrote to memory of 4496	2388	firefox.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Athletics Athletics.cmd & Athletics.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 734096
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Rw
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Recall" Date
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 734096\Sites.com + Goat + Fcc + Occurs + Solely + Varies + Cope + Minneapolis + Waves + Cad + Pipes 734096\Sites.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Giants + ..\Browse + ..\Creates + ..\Ton + ..\Announce + ..\Bg N
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\Sites.com
    Sites.com N
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4496
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06f20048-8de9-4660-bd29-e5c44be1cc8e} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" gpu
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2404 -prefMapHandle 2344 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fc74db8-7a43-48dc-9278-203597e7259c} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" socket
    3⤵
    PID:3784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3172 -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd5adca2-5545-4a43-831d-e6c3bf78f43f} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4100 -childID 2 -isForBrowser -prefsHandle 4088 -prefMapHandle 4084 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {add7861f-32e8-483d-8c82-4299721f76df} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4768 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4872 -prefMapHandle 4852 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11d11aea-b89b-49ba-8efe-b0d5ff382846} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" utility
    3⤵
    - Checks processor information in registry
    PID:1340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5316 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5304 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5fbd3ba6-9744-4972-a2f3-2e470726f8d6} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 4 -isForBrowser -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d031bb4-1c7a-4759-9a99-3f9f93187690} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5752 -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5680 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5f47c9d-5f77-46a9-864f-14052906a0fe} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6276 -childID 6 -isForBrowser -prefsHandle 6300 -prefMapHandle 6296 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea452550-b84b-4426-b135-ccfbcf12ed86} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:2532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5196 -childID 7 -isForBrowser -prefsHandle 5432 -prefMapHandle 5344 -prefsLen 28105 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05d48947-4575-410b-88f2-6322225abac1} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5396 -childID 8 -isForBrowser -prefsHandle 5408 -prefMapHandle 5404 -prefsLen 28105 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b1a8127-a000-4fc0-8cef-de6fbcc2096c} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:2280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5260 -childID 9 -isForBrowser -prefsHandle 6172 -prefMapHandle 5320 -prefsLen 28105 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37b1fa82-1e39-4431-8cb5-0729599cc0fc} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6896 -childID 10 -isForBrowser -prefsHandle 6764 -prefMapHandle 3752 -prefsLen 28105 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cc2dc47-d354-4918-9f2b-418d89fa495f} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6832 -childID 11 -isForBrowser -prefsHandle 6840 -prefMapHandle 7008 -prefsLen 28105 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79f1c01e-5b24-4df3-8bf7-b745450562c0} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4700 -childID 12 -isForBrowser -prefsHandle 4812 -prefMapHandle 7264 -prefsLen 28105 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01046dcd-b40c-43d6-a15c-871f38828615} 2388 "\\.\pipe\gecko-crash-server-pipe.2388" tab
    3⤵
    PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\N

Filesize
452KB

MD5
60b3ad1fd174753ea487b9ee310d8aa4

SHA1
a176b50ff0c5bbb16e6227c668d1184034702ccc

SHA256
0b5e613140cd5466ea42db897588d9b4d2ba1a5af8f4c96437a67c89c2385106

SHA512
00e697fa60c4ab17be95777514a43fc011726371dc94b950120cb51afb6a0d56961ccde2f7fdd8844c09fa044cefb69ed1fd5d23c8900d0eae5a41746feb5138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\Sites.com

Filesize
2KB

MD5
8a02802f62a57f55f3761b962b0af9eb

SHA1
356e4141ffa000d9c56c794ab53d78d0ae3c60bd

SHA256
585c5e677fa64256f945179dced7883946a03fd071a99366029149466e21ec5a

SHA512
f0166a959b7212f1810fb4061701ef23fec0ef91e4158ab29c8725d8055fcb05447a29f42e0a96962dbea540634263a8fb537b00289829c70912a091a2be5d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\Sites.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Announce

Filesize
55KB

MD5
94ac56ea9c57547530493471eb5ddb6c

SHA1
d1be7bb1748912d8fe74edcdf9d65e901662c04e

SHA256
bef5fcd6348c78be3792c8f4e67f648c2b725c61ece3f86999150cfe03403efb

SHA512
19935bddf5c3f728b0809a7836bdf9f6319ab4ce2b028712f36848976df6f834f01897560999eef452b624fdd2f6ece2957816e2a6557fdc522483bd196e447b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Athletics

Filesize
29KB

MD5
bf9adf8f6fc02be5a33b33f11d808517

SHA1
6e7094b5a90e42ac6670930137eb375f558f554e

SHA256
c37106cd45dcd032d32ad6e39080951480208742103f1c6a25a173e92a31a597

SHA512
e20fa87a7a3aad29b785ed7edec916fd2dbf05f848f6cb6d0b9fd95f0dc3880d7abccecc918d51407d14f34549e20ba4bb1c722e630182efe7034c58cdd16175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bg

Filesize
64KB

MD5
2b30ffed3dd824c446e8837d5141d85d

SHA1
d3170dc2cb8e6bd8552bfb5b237f41152a7d4d63

SHA256
07b2e543542f20e80be005e8914788a473accedcc8f902c6ba08e1e7ae282999

SHA512
ddf5ae19be5b1a12d560b0c70ef5281534a9a892e7a5e73d2708c1badb156d8e2343ab5b21163e3c7d1ac3f0dd2c7bbacf0438bdb50de3a564c4965c617933fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Browse

Filesize
78KB

MD5
043a2f10761506f6cf58b661a6c0177b

SHA1
3ec90eaeb4fab71d109119b0cea2b823144fef31

SHA256
dd89fe68ca8cc57814d51e3179e8894ffec19ff633c18cac999962b66246ed83

SHA512
74d9654e0fddc40b75464ec6303405483b69c8ebe88a298e83ae217582361af582009b829dd2d555d780ee43252d398abfe8a6b760e49124b15feb23cde5a5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cad

Filesize
106KB

MD5
57deff6464f64395a8ee414ddc6a88ab

SHA1
13928cdbf64fca67f4b14c2624a27f60815c4e05

SHA256
4069e829c77cac6eac9806eb539b45b6e1e1c083f701f19ab031c712bb6daa39

SHA512
d8076fca1ed03e2ee08ed236490fa9d3507614744fcde0891c35f85ac4a27794ee6d0f630a62b22774271bfd9e6c9c352829b1c3045aa1b7ecd984a85a4a4995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cope

Filesize
111KB

MD5
94c5391469808ca81c196f55e97ebba7

SHA1
4ede2f4cbf87e4c3aaa39e5ddd65c128f56c0978

SHA256
c25a817af856c7de3e29f5994e64cd3b86bfa51f354fadea6e55948218a71b49

SHA512
f16d942ed5b1d8d997b7a126d5180cbb5d179887d959cd83548ee13027158a38cae742545b47276b38f82f66de282ab1afc9d8e68cbb145edc832fc35bd5968b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Creates

Filesize
87KB

MD5
57e63e22ff5b3b46fbed205e528e33d3

SHA1
d600de61897d8ccad28f04eb57c35785cb92cf63

SHA256
881de3e5bd0e46fd38b03e517b0528c192c441784fda495e31df3e8f150071cb

SHA512
4e3374e005a5901e0f6647b0d02b5811c72ccc47a1fe99ae83556c8ef4e32daca50cc4efb64a0d12bcf750ddf5a50e19e20031fd77093bff74917dbcdb7b65b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Date

Filesize
2KB

MD5
67fccb0069e7922978d16c7443d5cbd0

SHA1
c25f55635314ee04f953ca97389464b32619f7af

SHA256
bca031b5a804d6e0804b5c2821731886a83685a393730bbee27b74e2acc773d9

SHA512
72c1bdfea3b8e96307bbf92132b208dc58e2f7c71cf1569d7506e9be3cb850a9e6a63408f312b07c472b4b2f64f11c97d772a482fe50f7f50a19ce907bae10ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fcc

Filesize
77KB

MD5
3ca748caf0b8f91b29866dbb1bb81620

SHA1
dbad5ad1109435a8cc787b46152dec63f8b67b1a

SHA256
823e5c344ddadcb6d2abbd3624ebecdb269f28a37ea3029c4dc7415083f4af69

SHA512
f19414422e011c9e4b4b666ae292c3305462006704aed254236301dedda0b6f171ea5e7dc6ccdb6eae5bd6ef91c567a0903bc47491ff30d54548a01de3da98d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Giants

Filesize
74KB

MD5
3ddbbf3436d11598ddb4b8b65c1c4909

SHA1
293bb8576efe46bc24ab3b7de5cb4c19104ef974

SHA256
607451fd45285e3b6c7caf7933690b639c8ccf84be2e0206273785e4c6a1d1f3

SHA512
8fe216b26838ae9a0a80612b36c97fc70f07ea3890fe285063614941f607a6a127923d037a2a817c28ae475b99c5befd4b8b7b67dcc9337a400ef32c47e3f49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Goat

Filesize
94KB

MD5
3ed253ac7c87676ad5d6d69f68ee25c6

SHA1
ab8c41d065ffa78e3c7a260ffc6e78da7640fb47

SHA256
ac47400ad46574f514a754733d8c4b48cb39adc9121e2b70883a86e00f47663c

SHA512
118181184d87a26c7d3c0620a843ce4bd62c926a3da3bc3295b65f5f7ff22006f38817461804f660e2a133ed156075acd54a6416c44ab8d110b09b1aec8db20c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Minneapolis

Filesize
55KB

MD5
5fc0f84929f1c7ea09260be20ad3c84e

SHA1
ab5180f1282246a42ebc33989e19adc845fe66bc

SHA256
9a44de836081f964db9ac9e01afdb45984ca0a757a7acba131a8f313b694ea1a

SHA512
998118d302738ae384dec30cd8f74407a448b056a6587942b879c09cffe41ffba79044301c349eb61d02c8a5108b6ff3c99afead78a0fc7d53b5d4e2218c18cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Occurs

Filesize
84KB

MD5
9c9407951cd57913450aac8b12e5b81c

SHA1
e9193055551f8c5860cebb201c113f7358bce94a

SHA256
7cf69e53f1284052140259f133ee343b3a44a515e2a0714827fa6face7c95053

SHA512
ed23decc4302334e7e828a00da039bc0d79ca8b70a8f528af1558a0c1ba58d2e58a7b1bac1a3ddf0b4b9e4415d1db34d5b80130c5a9dcde4783e1c2f0a535b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pipes

Filesize
98KB

MD5
4bba4173c91a3ed83a2996de048113e2

SHA1
4fec922bd21c5eb10ce53621d84972ba268bc4f9

SHA256
05df1b2bebaa59c767b3c0834ec086b97d262749e89b8fa15eb3aa46c7510bb1

SHA512
59528a4e1d5adbf8b0cf8e5921688109a9eca5086ce9cccbd4d20ed68bc2062b2a96c9041cc47345edd4d2bc3001bc50e2612eabdf36bb4323015baf0cf4077a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Rw

Filesize
477KB

MD5
e47e06b5e7ede6867a0261416dda4375

SHA1
7ac92bf4acf8bbe67bb838f85da3878957467477

SHA256
783efea8a55bca5affe2dfeef8c241a2ae6cde0856bcb5e6d6552ee0c364860c

SHA512
66661dcfd016cf88bafef82f13a407fa0faaefb9a342a2905fdcb47600096dbfc087d72c97a9d5f390c171bfdacfdebe4634d4558e0da7fa2e9549d828950e96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Solely

Filesize
71KB

MD5
7b5476b9432e0ba9204fca9ff75a2b2d

SHA1
2f0e8253adbb1b955957b7e12d514a28cfa31ca0

SHA256
2af48411f4c96f27028aab420347e1493d22cd8887cf7235ba44ccb80b912436

SHA512
19ab860e475fd908d20763a52f561fcc9154f6cb50efe81e10b5f574526cb74065e181a38e211bfa5029bdef70cb8f95fc9ab1c0f5f0dc7b321b9df63b410dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ton

Filesize
94KB

MD5
91c207267b61ab51aafabc0851d7e573

SHA1
b3e1cae133260c38f938beaebeecdb0b9d1ef3fa

SHA256
929551587f4744e2a01bbcc3ebfb5fba3c24909571e868ac726fdd5727158a02

SHA512
c799fa3aad5bc5ff8fdae92395c8afabe99dd5ce853a2cd6a30d4b340a5e4d8c0339876b4a5574deb5cbefd67bfd0e1c13aafbcfcde2f6e4af67c80632662094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Varies

Filesize
133KB

MD5
8e789ca1357fe23d5aa98a136e829f2e

SHA1
2a2174c3d28192e3bcde9a44373aea18546f38ea

SHA256
25623b8068b2b5d02fa7113448de22574d01252f75a0357b07cf2c7e4a2232a1

SHA512
c622aa6a504f9bf538fce496b375646ec37109085e243770545a9f2e881243081dce0c7e45ed39c1ccbf896e930068528668c9d1bbe2398b639d21325a098fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Waves

Filesize
94KB

MD5
d33d4f3a077a80ea84f1b8563bc2e66d

SHA1
bd82698647f925797d8f5ccf1c3c5752275c6805

SHA256
7f26fd27f55e5defd6368a7c48fa7060d86c60e1dbab8234a74f0dc9da2b7a8d

SHA512
e4e6a38b6ff9179422d5c3ded4753c70d083bdb4b47f7c282529cfbfd408920449fec39d50f639021c41daa27472ca7deb11678cd4d781d862d9d9af6dfcd706

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
6b0682c6c5e0c103a25c7e8847e1331a

SHA1
502225fdc753595e8602bb2e4bb3dccecfd492db

SHA256
69a8059495a48097bb4d0c8e950fd2b4b078d6a6ba92e4354728f1d3c33a4c21

SHA512
74823a01143aff88a81e07896f68233bb5dd22d0bd3ca2eeade527df39819ee94381857f426bc4a7053f5b762d436fcdc8cb58d4e856c1e75ebd3e3177aa2bd3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\cache2\doomed\14199

Filesize
14KB

MD5
75e507ba524c7c72072952100462a002

SHA1
04c034b9299089e1aaa594b53008ed2100706f3a

SHA256
5597518b9b6a1f3a3c467b4762f9efc4aa642d5914c768ee289b5bb91ddf1766

SHA512
2d62f1f6fefb24ee4ff8da9b8b3642a0513a122d2f0aaaec52552f77c411c1cb6ca5c3b37346654460bd3a39ab2561dbf440f8f8c7fd04cd07104bfd1c2505d9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\cache2\doomed\22616

Filesize
13KB

MD5
29d1d02607b81ab84a381cd865c53e1c

SHA1
4662874f3cc47a22150ca0a4428d87db9bb3b235

SHA256
ab54cd5abe88502bfdcb9b9f298fc8c6b947a4b463c9e846ba50e516bf5b0d67

SHA512
54879d41b54dbae4769dadeee5de4c33a3a0b40199399efdc5b4de76311126bd46dedf0440ed9efd08a8d53bb93f8dfef679dfe855e94e9523f0fe7e16029d51

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\cache2\entries\2DEB3B81EB96245D9BC1CF71DE19C61850835DAB

Filesize
45KB

MD5
4bdc20f0afcc8341d14bb576677decc0

SHA1
b6483ffb9d698e945dbdbf4d7a0bf0b00b4dd161

SHA256
38cd9aa174b9aeb5906076d9e88b30b827ae8f014df2f5815c574eb8f84b9323

SHA512
2fb9edfae92de97e222792a7ffa6f60f41e07cad344ae0fac6ec6e64a979396884b86137d29e7024fdb6ec567f93e3d082875dc1437d559b58d23ec1d5f21794

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9enwga8g.default-release\cache2\entries\DBAA386F82CE562854C5581F7379CD2DA283AD50

Filesize
224KB

MD5
738275aa57aa7bf1d3c5e7c5fa2e0bf1

SHA1
8732861b4adfabdb8a94306518d5addcc814059f

SHA256
2af0caebb0d59e0ac45079faa3b7d226440a6e3d521d37343452db7e3d21ee0b

SHA512
7c60d0e63057d253919289e1015260cc3d40d7c54fb10b91edd21f8d764f95c3cf497bd1d82f6bdb35d5d09715abf2056141fda823dcfde0fd2de17cd68cfa2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\AlternateServices.bin

Filesize
7KB

MD5
3b73eccb71829be7f2edc3160ee78ed0

SHA1
44c0ecebe8d393dd773cd73e6bd4248be73e7ee3

SHA256
5e44f36dd05bf728009bb2f87a7d0759878f90c0a950dea595d4b83e11fc0ece

SHA512
1a462db67e171b694920a778ab3ba824ccd46449c04e35cc3ae6ef7d0ff3e20af5060f04efa906724f7bb1e85f4401c2ff094855732d3b2acac5a2d37f79a097

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\AlternateServices.bin

Filesize
12KB

MD5
9a9e611aee26065ac24c58b4811ffed9

SHA1
6c15279b4a0943d70a8488d43881f1557f3074bd

SHA256
c8e656333824751081b6b78d705b867f292078faa175041aab4755b68f3651bd

SHA512
a712c09e947e0019cec2ee14a5c26e053274ac5b8d08dc9586737cec29ff58f63d14d2cd88a42a001fa7c41c8c2daf82d4fa8b8a02bb82814e624b4c68ae83c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
0e1bb5ddd43295218fe4c369a48f24f2

SHA1
3f909c63aba8e2f29295c78024c2423d6bb3e87d

SHA256
d0f61d3598bae482b440af5205012d41d4877ba8372a3b9c0e7bd0593175a48d

SHA512
f5601ec3ffe07fbb2eb54453f9876c19098c3773f76a21ead863bb19fb2adcd26517ec73001248303fc510f87d9e9afe852e9c4c974b90e480400bf30c11695d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\db\data.safe.tmp

Filesize
17KB

MD5
805f37dcd319dd53d8a321dc121c9ff7

SHA1
4e9be171896d67f51282c75d8237ca6bb7e3de55

SHA256
8bb8c31e00f027daf107c62e16f1c99b233ac492865409c708a97d59bf7bb90d

SHA512
e8c40f8b4f98dd8ead7b2df46ce991f793874639e9313e447cf8eca1b547080f3d85d1d8feae6c026bb46466d65652cd235d1f7f9a7d6b994fd7c0d097e234ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\pending_pings\3903539c-e4fc-4916-8b37-286e602f996f

Filesize
671B

MD5
8a26ff9b0dd2158905f800cae86ab577

SHA1
730a9cbd80c01c7b5ba6730038a8662a67bd0aa8

SHA256
5602549b5232e843da505ba27019133bd94589aaa5fb3ffe69ec741de075d81b

SHA512
5f575869f75ff30516328cd87d396551c05f8346e8942eee97e8524b65b22ad14f02377ba05adad442eeb8869f0e1ab7551dda044b354878e6fcce59d92384f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\pending_pings\9a6e74a0-01ca-4566-83d9-df0276b821a0

Filesize
982B

MD5
a8924af05c31dcf224b55225b7efe858

SHA1
f4a3e539fca87fdde47f27c129e578a0d1f938a5

SHA256
47580ed56b6de1fa43cdbc093891dceb979dd46fb2b2cba5a3e170b0d2d3dc3e

SHA512
6a5a8e06e6bf22aba3d57256f7705a2af77b36264786968e160a0d531737f6efe8fa355c61d0dd0a94a27af9ddf151bf46cf2691638c911d99ac5e3385e01bdf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\datareporting\glean\pending_pings\f9c82793-2677-4d4d-b0a5-46918e19b65d

Filesize
25KB

MD5
ec656514659e4468cbdd39abde7649c0

SHA1
b52b0b36c02b08c5e19f0ca1b4667545ec08862b

SHA256
db5fb2567e898226987e5083713fdab75b077ea3745e0e364a53df792870e365

SHA512
497e7d7b2813f8a09e41a413030fc73535ff852b5ee154929c6b26a836c963749ef8493384b349337c5f65503982a998562ee95442e43344b5160012f9ff131e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\prefs-1.js

Filesize
11KB

MD5
88046c8c4973b1beb6ba8592ed501e32

SHA1
d15ef9f679f4110a93f7755b5f638640ca19b8c8

SHA256
cfcd245598543f694c8731e86094dbf7aad65348628e940ce9838062c24de5c3

SHA512
5ac498d1f359b8349d6c4e9c265e32babe6603f2596792fdacecf924a3286fd5dfd246f296099866968c8e27fcbcb8b8e44a9fe457f9968b26a81f2508e75199

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\prefs.js

Filesize
10KB

MD5
e5e2619cd4dadc0f9592224898c6534b

SHA1
3e19c95eeb5b85f562ac40233a684d816a8ae220

SHA256
3b0efe28d77c5d3f3e2a8662bcc6878a6d520e53f3bf0203f7c0def802415f2e

SHA512
bf54c69fe8966411c99998e2d826536c2b9542c5cb8f3f613ec46da1486f2c7dd1ac4f1d86445b0e4f7742878b02dc7a8b59fdd09998a2e6335d9aebdfcaa290

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\prefs.js

Filesize
10KB

MD5
3ab6d0f4f2cb98b758ddcdecd1a308fc

SHA1
8b7add7a06108d23a931bbbd2287420fc8928741

SHA256
70a8bf9ef6f7509103b4a0742f984bf4b8418c5aead34e6311493374402c32af

SHA512
040bff43cb9903e8174d15fda308b57c0523e31d11d674a930022533757361b409f7e2a0558da276ddf10cdea19c1f1461d2a7e12c05245f7e6eb97a5e313695

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
863f0243097753e21af42f285fc53f96

SHA1
4f24fd2923046f2eefce0322da7be65253a0b4f6

SHA256
a5362fd0c59704cdbb90f194d7625449fb3142663aa1b2ef671943c18cc73b79

SHA512
2d60e6cd380c13f82293d29b3187a29df344edacb43a7067071201a634f73408ed373afa6c141c374754e4514b4b6797f4e4fcd28da24e4267075cacdf5e9834

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
6c7981e7624c66cb9b602ddf6d24e373

SHA1
bd66db3ba209feffa70964fd221101f0f122f219

SHA256
a258138b119d9af5e45b71b6cdc123e92acb03ecf44e890a36f992b764767a8b

SHA512
fa2026d0c1edc8c6739de43fccb2fbd5fdb7a7bcb98b9cebc1708e40ba7ae4f884c0f5b9c73e46901fdff04b52e3c0509038a176b7772331db9240d4d79d9773

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
8681ecc447ce07ad47da3d5d7bad1cdb

SHA1
4f303ca78e68747b03dcc57c142b6c966be56df7

SHA256
c2c07930d42ba7c21e51c7fb10e7976dad1e96e6f3bb556b1e6266c06f52cfc9

SHA512
79d26094db800d8c59acee0df5bcc7068052d9f5416127fbc273018c7b68346baedbdd22218a8393d6bc49b480eff5c7a3ffb47c65a2950dd35b700aa0e269d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\sessionstore-backups\recovery.baklz4

Filesize
6KB

MD5
30fcd742e553ff78decd8a9d0873c406

SHA1
70f1b8d4add1316c5bd35218326514048a542cc3

SHA256
c834f7e2b4b4093c5e1fa3ff5bb8efaaa429bcd7c41406804348d1e5d93c2916

SHA512
6344f724e27111ca325e69194aae2a69069b52b4f5187eb6a16464a11333bbd43daff9de4d593ccb0fadd00b80484a6281b13f443d33d2ee54239c41c306cd65

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\storage\default\https+++www.virustotal.com\cache\morgue\110\{eae0614e-d0cd-460c-ad1d-b1a8ba51de6e}.final

Filesize
50KB

MD5
5dfc1d8e37280885d27e8267aafa32b1

SHA1
b3aed5ded4341ee77cb2a9446cbcf13ad50c162a

SHA256
4e6b9f01fe4f833a68dcb8c5d51518d9179c57b5d53a602e1c51cd22feea947d

SHA512
2832ffad5db7c55bd0f0040882709d6b16220802bb39c7426ef26d9b446dbe34ce01deeeb4a198c2b9daa77bd173534d24abdfe3e12c1a3d08d9d36afa622cfd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9enwga8g.default-release\storage\default\https+++www.virustotal.com\cache\morgue\149\{6f8600a8-a66b-4b24-9b40-97250a01dc95}.final

Filesize
7KB

MD5
88401fc31186f6e3607ed736f1a1705e

SHA1
6f6db25498765dad902d74c88eaedc73e403acf9

SHA256
b45518b79e7cadc6ba0671a033bcfbb7632d999e3d21feca346b413d8ab9ac30

SHA512
07033b3b56d8f1a32784539a5bb3cc5dd970736f04ef3d4e7ca2fba3dc8082c1ea4c5b7faa59bba80b4bfcb1a9d18f720029ca92cccf5f0f328272864be2efc4

Download Submit
memory/1936-81-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-76-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-79-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-80-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-77-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-75-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-71-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-78-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-70-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/1936-69-0x00000209EDC90000-0x00000209EDC91000-memory.dmp

Filesize
4KB

Download
memory/4496-86-0x0000000004B40000-0x0000000004B96000-memory.dmp

Filesize
344KB

Download
memory/4496-85-0x0000000004B40000-0x0000000004B96000-memory.dmp

Filesize
344KB

Download
memory/4496-82-0x0000000004B40000-0x0000000004B96000-memory.dmp

Filesize
344KB

Download
memory/4496-84-0x0000000004B40000-0x0000000004B96000-memory.dmp

Filesize
344KB

Download
memory/4496-83-0x0000000004B40000-0x0000000004B96000-memory.dmp

Filesize
344KB

Download