lumma | 3bdc57e936012fc092277a2e3d719e4ef00d476198f13d1fff180b6c49f81a6d

Analysis

max time kernel
300s
max time network
267s
platform
windows11-21h2_x64
resource
win11-20241007-fr
resource tags

arch:x64arch:x86image:win11-20241007-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
02-01-2025 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

70.0MB
MD5

f12e87197e19cb59d8495f03cac277b2
SHA1

34eb2318335988399bc25702a0d557f8c3101f11
SHA256

3bdc57e936012fc092277a2e3d719e4ef00d476198f13d1fff180b6c49f81a6d
SHA512

eecbecbd873e24221ca28dfbbb9edb5b33853c5790e7ec8342e19e969f0077d9d2528a7c13b4e9f4e0b4386508a9efcc95fb9ff1d4744f45f84141f2838f2b68
SSDEEP

24576:cv29nUaE0Nkgh3hiC3zfJhS+bQfn+pVqo7VaLGL/23ry:ywnUCdhx9c/+pVlhaiCu

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
836	Sites.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4516	tasklist.exe
3552	tasklist.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DrumSleeve	Setup.exe
File opened for modification	C:\Windows\GreaterMuslims	Setup.exe
File opened for modification	C:\Windows\SavageStrategy	Setup.exe
File opened for modification	C:\Windows\PurpleConstraint	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sites.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
836	Sites.com
836	Sites.com
836	Sites.com
836	Sites.com
836	Sites.com
836	Sites.com
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4848	taskmgr.exe
4992	firefox.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	tasklist.exe
Token: SeDebugPrivilege	3552	tasklist.exe
Token: SeDebugPrivilege	4848	taskmgr.exe
Token: SeSystemProfilePrivilege	4848	taskmgr.exe
Token: SeCreateGlobalPrivilege	4848	taskmgr.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
836	Sites.com
836	Sites.com
836	Sites.com
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4848	taskmgr.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
836	Sites.com
836	Sites.com
836	Sites.com
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe
4848	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1136	5004	Setup.exe	77
PID 5004 wrote to memory of 1136	5004	Setup.exe	77
PID 5004 wrote to memory of 1136	5004	Setup.exe	77
PID 1136 wrote to memory of 4516	1136	cmd.exe	79
PID 1136 wrote to memory of 4516	1136	cmd.exe	79
PID 1136 wrote to memory of 4516	1136	cmd.exe	79
PID 1136 wrote to memory of 2012	1136	cmd.exe	80
PID 1136 wrote to memory of 2012	1136	cmd.exe	80
PID 1136 wrote to memory of 2012	1136	cmd.exe	80
PID 1136 wrote to memory of 3552	1136	cmd.exe	82
PID 1136 wrote to memory of 3552	1136	cmd.exe	82
PID 1136 wrote to memory of 3552	1136	cmd.exe	82
PID 1136 wrote to memory of 2364	1136	cmd.exe	83
PID 1136 wrote to memory of 2364	1136	cmd.exe	83
PID 1136 wrote to memory of 2364	1136	cmd.exe	83
PID 1136 wrote to memory of 3652	1136	cmd.exe	84
PID 1136 wrote to memory of 3652	1136	cmd.exe	84
PID 1136 wrote to memory of 3652	1136	cmd.exe	84
PID 1136 wrote to memory of 1872	1136	cmd.exe	85
PID 1136 wrote to memory of 1872	1136	cmd.exe	85
PID 1136 wrote to memory of 1872	1136	cmd.exe	85
PID 1136 wrote to memory of 4764	1136	cmd.exe	86
PID 1136 wrote to memory of 4764	1136	cmd.exe	86
PID 1136 wrote to memory of 4764	1136	cmd.exe	86
PID 1136 wrote to memory of 2608	1136	cmd.exe	87
PID 1136 wrote to memory of 2608	1136	cmd.exe	87
PID 1136 wrote to memory of 2608	1136	cmd.exe	87
PID 1136 wrote to memory of 4580	1136	cmd.exe	88
PID 1136 wrote to memory of 4580	1136	cmd.exe	88
PID 1136 wrote to memory of 4580	1136	cmd.exe	88
PID 1136 wrote to memory of 836	1136	cmd.exe	89
PID 1136 wrote to memory of 836	1136	cmd.exe	89
PID 1136 wrote to memory of 836	1136	cmd.exe	89
PID 1136 wrote to memory of 1012	1136	cmd.exe	90
PID 1136 wrote to memory of 1012	1136	cmd.exe	90
PID 1136 wrote to memory of 1012	1136	cmd.exe	90
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 2092 wrote to memory of 4992	2092	firefox.exe	110
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111
PID 4992 wrote to memory of 3936	4992	firefox.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Athletics Athletics.cmd & Athletics.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2012
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 734096
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3652
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Rw
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Recall" Date
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 734096\Sites.com + Goat + Fcc + Occurs + Solely + Varies + Cope + Minneapolis + Waves + Cad + Pipes 734096\Sites.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Giants + ..\Browse + ..\Creates + ..\Ton + ..\Announce + ..\Bg N
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\Sites.com
    Sites.com N
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:836
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1828

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:2848

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c5633dd-6ca2-47ff-bd51-33a27e010a42} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" gpu
    3⤵
    PID:3936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2312 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4833153d-78d9-4783-9336-e5298cfdb11f} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" socket
    3⤵
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3212 -childID 1 -isForBrowser -prefsHandle 3204 -prefMapHandle 3200 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdbb27fe-21c3-49f5-915d-8111eb260a46} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:1404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3924 -childID 2 -isForBrowser -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e7f1151-89b6-42a5-a504-f390c89f601c} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:2212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4696 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4752 -prefMapHandle 4748 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e66212-c57d-4653-803b-d1064cd936bf} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" utility
    3⤵
    - Checks processor information in registry
    PID:5172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5464 -childID 3 -isForBrowser -prefsHandle 5444 -prefMapHandle 5432 -prefsLen 27177 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f20701f-b1db-4007-97e8-664a67020eb7} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:6024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 4 -isForBrowser -prefsHandle 5632 -prefMapHandle 5636 -prefsLen 27177 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1a88ab3-1462-4612-bf26-9474f41e938f} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:6036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5868 -childID 5 -isForBrowser -prefsHandle 5788 -prefMapHandle 5792 -prefsLen 27177 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e63e5d00-c660-4b7d-95ad-495122cbe640} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:6048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6192 -childID 6 -isForBrowser -prefsHandle 6184 -prefMapHandle 6172 -prefsLen 27177 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a384dd9c-c618-4fc4-b902-0c925e8084d0} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:5424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -childID 7 -isForBrowser -prefsHandle 5488 -prefMapHandle 5504 -prefsLen 28104 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac5222ec-0412-49ed-adac-8d5b7a17e228} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:3380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -childID 8 -isForBrowser -prefsHandle 4604 -prefMapHandle 3632 -prefsLen 28104 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71d78495-f57f-479e-9735-1e00e9594631} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6192 -childID 9 -isForBrowser -prefsHandle 6544 -prefMapHandle 6552 -prefsLen 28104 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50f6ded1-dbcf-4ef2-8b70-d1959b5be5c6} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6708 -childID 10 -isForBrowser -prefsHandle 6716 -prefMapHandle 6720 -prefsLen 28104 -prefMapSize 244658 -jsInitHandle 1168 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb58600a-408d-4569-bf72-31fee49551d1} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" tab
    3⤵
    PID:5992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\N

Filesize
452KB

MD5
60b3ad1fd174753ea487b9ee310d8aa4

SHA1
a176b50ff0c5bbb16e6227c668d1184034702ccc

SHA256
0b5e613140cd5466ea42db897588d9b4d2ba1a5af8f4c96437a67c89c2385106

SHA512
00e697fa60c4ab17be95777514a43fc011726371dc94b950120cb51afb6a0d56961ccde2f7fdd8844c09fa044cefb69ed1fd5d23c8900d0eae5a41746feb5138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\Sites.com

Filesize
2KB

MD5
8a02802f62a57f55f3761b962b0af9eb

SHA1
356e4141ffa000d9c56c794ab53d78d0ae3c60bd

SHA256
585c5e677fa64256f945179dced7883946a03fd071a99366029149466e21ec5a

SHA512
f0166a959b7212f1810fb4061701ef23fec0ef91e4158ab29c8725d8055fcb05447a29f42e0a96962dbea540634263a8fb537b00289829c70912a091a2be5d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\734096\Sites.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Announce

Filesize
55KB

MD5
94ac56ea9c57547530493471eb5ddb6c

SHA1
d1be7bb1748912d8fe74edcdf9d65e901662c04e

SHA256
bef5fcd6348c78be3792c8f4e67f648c2b725c61ece3f86999150cfe03403efb

SHA512
19935bddf5c3f728b0809a7836bdf9f6319ab4ce2b028712f36848976df6f834f01897560999eef452b624fdd2f6ece2957816e2a6557fdc522483bd196e447b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Athletics

Filesize
29KB

MD5
bf9adf8f6fc02be5a33b33f11d808517

SHA1
6e7094b5a90e42ac6670930137eb375f558f554e

SHA256
c37106cd45dcd032d32ad6e39080951480208742103f1c6a25a173e92a31a597

SHA512
e20fa87a7a3aad29b785ed7edec916fd2dbf05f848f6cb6d0b9fd95f0dc3880d7abccecc918d51407d14f34549e20ba4bb1c722e630182efe7034c58cdd16175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bg

Filesize
64KB

MD5
2b30ffed3dd824c446e8837d5141d85d

SHA1
d3170dc2cb8e6bd8552bfb5b237f41152a7d4d63

SHA256
07b2e543542f20e80be005e8914788a473accedcc8f902c6ba08e1e7ae282999

SHA512
ddf5ae19be5b1a12d560b0c70ef5281534a9a892e7a5e73d2708c1badb156d8e2343ab5b21163e3c7d1ac3f0dd2c7bbacf0438bdb50de3a564c4965c617933fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Browse

Filesize
78KB

MD5
043a2f10761506f6cf58b661a6c0177b

SHA1
3ec90eaeb4fab71d109119b0cea2b823144fef31

SHA256
dd89fe68ca8cc57814d51e3179e8894ffec19ff633c18cac999962b66246ed83

SHA512
74d9654e0fddc40b75464ec6303405483b69c8ebe88a298e83ae217582361af582009b829dd2d555d780ee43252d398abfe8a6b760e49124b15feb23cde5a5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cad

Filesize
106KB

MD5
57deff6464f64395a8ee414ddc6a88ab

SHA1
13928cdbf64fca67f4b14c2624a27f60815c4e05

SHA256
4069e829c77cac6eac9806eb539b45b6e1e1c083f701f19ab031c712bb6daa39

SHA512
d8076fca1ed03e2ee08ed236490fa9d3507614744fcde0891c35f85ac4a27794ee6d0f630a62b22774271bfd9e6c9c352829b1c3045aa1b7ecd984a85a4a4995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cope

Filesize
111KB

MD5
94c5391469808ca81c196f55e97ebba7

SHA1
4ede2f4cbf87e4c3aaa39e5ddd65c128f56c0978

SHA256
c25a817af856c7de3e29f5994e64cd3b86bfa51f354fadea6e55948218a71b49

SHA512
f16d942ed5b1d8d997b7a126d5180cbb5d179887d959cd83548ee13027158a38cae742545b47276b38f82f66de282ab1afc9d8e68cbb145edc832fc35bd5968b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Creates

Filesize
87KB

MD5
57e63e22ff5b3b46fbed205e528e33d3

SHA1
d600de61897d8ccad28f04eb57c35785cb92cf63

SHA256
881de3e5bd0e46fd38b03e517b0528c192c441784fda495e31df3e8f150071cb

SHA512
4e3374e005a5901e0f6647b0d02b5811c72ccc47a1fe99ae83556c8ef4e32daca50cc4efb64a0d12bcf750ddf5a50e19e20031fd77093bff74917dbcdb7b65b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Date

Filesize
2KB

MD5
67fccb0069e7922978d16c7443d5cbd0

SHA1
c25f55635314ee04f953ca97389464b32619f7af

SHA256
bca031b5a804d6e0804b5c2821731886a83685a393730bbee27b74e2acc773d9

SHA512
72c1bdfea3b8e96307bbf92132b208dc58e2f7c71cf1569d7506e9be3cb850a9e6a63408f312b07c472b4b2f64f11c97d772a482fe50f7f50a19ce907bae10ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fcc

Filesize
77KB

MD5
3ca748caf0b8f91b29866dbb1bb81620

SHA1
dbad5ad1109435a8cc787b46152dec63f8b67b1a

SHA256
823e5c344ddadcb6d2abbd3624ebecdb269f28a37ea3029c4dc7415083f4af69

SHA512
f19414422e011c9e4b4b666ae292c3305462006704aed254236301dedda0b6f171ea5e7dc6ccdb6eae5bd6ef91c567a0903bc47491ff30d54548a01de3da98d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Giants

Filesize
74KB

MD5
3ddbbf3436d11598ddb4b8b65c1c4909

SHA1
293bb8576efe46bc24ab3b7de5cb4c19104ef974

SHA256
607451fd45285e3b6c7caf7933690b639c8ccf84be2e0206273785e4c6a1d1f3

SHA512
8fe216b26838ae9a0a80612b36c97fc70f07ea3890fe285063614941f607a6a127923d037a2a817c28ae475b99c5befd4b8b7b67dcc9337a400ef32c47e3f49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Goat

Filesize
94KB

MD5
3ed253ac7c87676ad5d6d69f68ee25c6

SHA1
ab8c41d065ffa78e3c7a260ffc6e78da7640fb47

SHA256
ac47400ad46574f514a754733d8c4b48cb39adc9121e2b70883a86e00f47663c

SHA512
118181184d87a26c7d3c0620a843ce4bd62c926a3da3bc3295b65f5f7ff22006f38817461804f660e2a133ed156075acd54a6416c44ab8d110b09b1aec8db20c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Minneapolis

Filesize
55KB

MD5
5fc0f84929f1c7ea09260be20ad3c84e

SHA1
ab5180f1282246a42ebc33989e19adc845fe66bc

SHA256
9a44de836081f964db9ac9e01afdb45984ca0a757a7acba131a8f313b694ea1a

SHA512
998118d302738ae384dec30cd8f74407a448b056a6587942b879c09cffe41ffba79044301c349eb61d02c8a5108b6ff3c99afead78a0fc7d53b5d4e2218c18cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Occurs

Filesize
84KB

MD5
9c9407951cd57913450aac8b12e5b81c

SHA1
e9193055551f8c5860cebb201c113f7358bce94a

SHA256
7cf69e53f1284052140259f133ee343b3a44a515e2a0714827fa6face7c95053

SHA512
ed23decc4302334e7e828a00da039bc0d79ca8b70a8f528af1558a0c1ba58d2e58a7b1bac1a3ddf0b4b9e4415d1db34d5b80130c5a9dcde4783e1c2f0a535b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pipes

Filesize
98KB

MD5
4bba4173c91a3ed83a2996de048113e2

SHA1
4fec922bd21c5eb10ce53621d84972ba268bc4f9

SHA256
05df1b2bebaa59c767b3c0834ec086b97d262749e89b8fa15eb3aa46c7510bb1

SHA512
59528a4e1d5adbf8b0cf8e5921688109a9eca5086ce9cccbd4d20ed68bc2062b2a96c9041cc47345edd4d2bc3001bc50e2612eabdf36bb4323015baf0cf4077a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Rw

Filesize
477KB

MD5
e47e06b5e7ede6867a0261416dda4375

SHA1
7ac92bf4acf8bbe67bb838f85da3878957467477

SHA256
783efea8a55bca5affe2dfeef8c241a2ae6cde0856bcb5e6d6552ee0c364860c

SHA512
66661dcfd016cf88bafef82f13a407fa0faaefb9a342a2905fdcb47600096dbfc087d72c97a9d5f390c171bfdacfdebe4634d4558e0da7fa2e9549d828950e96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Solely

Filesize
71KB

MD5
7b5476b9432e0ba9204fca9ff75a2b2d

SHA1
2f0e8253adbb1b955957b7e12d514a28cfa31ca0

SHA256
2af48411f4c96f27028aab420347e1493d22cd8887cf7235ba44ccb80b912436

SHA512
19ab860e475fd908d20763a52f561fcc9154f6cb50efe81e10b5f574526cb74065e181a38e211bfa5029bdef70cb8f95fc9ab1c0f5f0dc7b321b9df63b410dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ton

Filesize
94KB

MD5
91c207267b61ab51aafabc0851d7e573

SHA1
b3e1cae133260c38f938beaebeecdb0b9d1ef3fa

SHA256
929551587f4744e2a01bbcc3ebfb5fba3c24909571e868ac726fdd5727158a02

SHA512
c799fa3aad5bc5ff8fdae92395c8afabe99dd5ce853a2cd6a30d4b340a5e4d8c0339876b4a5574deb5cbefd67bfd0e1c13aafbcfcde2f6e4af67c80632662094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Varies

Filesize
133KB

MD5
8e789ca1357fe23d5aa98a136e829f2e

SHA1
2a2174c3d28192e3bcde9a44373aea18546f38ea

SHA256
25623b8068b2b5d02fa7113448de22574d01252f75a0357b07cf2c7e4a2232a1

SHA512
c622aa6a504f9bf538fce496b375646ec37109085e243770545a9f2e881243081dce0c7e45ed39c1ccbf896e930068528668c9d1bbe2398b639d21325a098fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Waves

Filesize
94KB

MD5
d33d4f3a077a80ea84f1b8563bc2e66d

SHA1
bd82698647f925797d8f5ccf1c3c5752275c6805

SHA256
7f26fd27f55e5defd6368a7c48fa7060d86c60e1dbab8234a74f0dc9da2b7a8d

SHA512
e4e6a38b6ff9179422d5c3ded4753c70d083bdb4b47f7c282529cfbfd408920449fec39d50f639021c41daa27472ca7deb11678cd4d781d862d9d9af6dfcd706

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
44f165951ff579e9c296fc9746ea0f28

SHA1
a8b5910284e73884303a8d9a2dae25ca384230e4

SHA256
214b37d70715e7526f2278cda6a04b4d424eff4b203d7c0b640309a4f6e3985d

SHA512
40664474277c32553bbe1dec08589c145b9ebc873a07a9ca68308c27182f95cd343f0858218c35268cc72a1e1b836ada3dd49f866db45a47e372ec82dc919faf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\cache2\doomed\15103

Filesize
14KB

MD5
afabb3d156ea9051b2337bd3669edb81

SHA1
a5be8ddbfb2914b37fa60d6da2861eeb2d79c350

SHA256
c5bfb6b031384ce5d9ee617e078a027a190b525f841f71acb33fcec455843fa1

SHA512
21c48f64d20fb0b57a1f6ffc56327c5d68ea2865cb64effba4869dea703869c811f360c13ef2d43fe85a4c9c1a92325477e522d62e1d44cea33310312289a1f5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\cache2\entries\DBAA386F82CE562854C5581F7379CD2DA283AD50

Filesize
224KB

MD5
a86287da93b818fc262266a34666c868

SHA1
08f8fa93632e7f3da6cd33e438ddd836495a445c

SHA256
802776dc8030ad69702fe94c8408eef30ff1e4f2f4419615f26d1a56cd1d6849

SHA512
2c1d1826765fee1f7bf711f39fd3e0dae140983ec268b78d00425d43421eff89ed74a4504a6a5fedd3bdebfeed163ddc08cfefb7d512dfa5c874ebe289637c28

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\jumpListCache\5BTyx82zh3UcvtrroLGHwmCEQNWK_Kx+Fv_iuraNJw4=.ico

Filesize
15KB

MD5
a3c1306e53848dce3a3c2fec6e1cdff2

SHA1
87f8463535c624202f9b6efe26e993b0b1f3157c

SHA256
d2d32f8573ccc7ad555d258c8362cfb0b699eb4b004f93dbeb171f3510df055f

SHA512
871e877c73990e372a7a41d9851e9dcf301efdc543696aa4dbc35b8a121e24b7fcdf76d426b5f90fa3a14253440697de01ffa0d82d417e5490560ce7d9740aa1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\5d82cc31-ea71-47c7-8a82-4b7a085b6717.down_data

Filesize
132KB

MD5
1782244d9f1821c9a63a5087a6e0afd0

SHA1
e75a848a04723c9bbb675e5e2b4cfa5e1ce42368

SHA256
df82425d8726e49ebf5f80c9133ff65b38a6513771033fc1c59df02590472877

SHA512
6b29fd74305e1cb5cd21b235f83b88a49c1df0e7da099ad5512fd34c47d5ea0d3bba7faf84e2116ee6bef69b1b366ec84c1610a1bc44b22bb67a6c8c871d489e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\AlternateServices.bin

Filesize
6KB

MD5
3f4e6b5d3917012a41a8e4a2ba0178c3

SHA1
1f7c50ff2ec317bd45284e6c5cce263b0cb1d653

SHA256
e56740b93b355f010f04e60a6f0f81aeca7adcd7ba4c64a49bd5168bad15ea3a

SHA512
4805c608c8848e96d71eb09be763b471695ddc6e854eb6afd8989d651c2c7a1ca205d733940088f0a46d22160f27547381b99c36fcc2c6192a6ad42ca0214596

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\AlternateServices.bin

Filesize
12KB

MD5
e5eb662c456e0af2ad7cb746244abf8a

SHA1
8c3bedeb5c0b8ea50f1d29393b8d593c83424c28

SHA256
ffc0f2002a2b6a6e83b546c0fd52942523dc2e921bf66851d97e0f12e471b1da

SHA512
a07abfd4395439a53a01d7b5de1cb4d3cff85024c6af701b2e8b1e671c3aaa88bdaecf83b17d64fbc1d478a2473091498f129437563bc3110f56303cf5bbf666

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
68b7f5925f57107049924af43cdc86cf

SHA1
97b342522aa197ebb1d56f4a1606bde14ccbe1cf

SHA256
526db3b00f039c23c0e8e463c938486395ec9f64ec220f1bfae608df122357b0

SHA512
80a73db356389db95017ce5a0ecbce1df805137110cc5f2e396f8ca20dfd2b0a50dd1b50cb730127116bc97ff07418a83ccb46556a75ca64bb675d2c4960d452

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
46b782d23d0a90f977229d616d4b55ca

SHA1
5fdcf7c4afe3ab927b91ff0fe0d2865afda33c2e

SHA256
f4a9dea8b5c9bd1f06167737733048c5319cfd23fe9f8dfa9b71f2038d8b6801

SHA512
2ad87bc15a1585669b81243f49c2a984b95c8038960d810cbb38384366a572377149c52d4656c44aca71f06f61602f4aee5ff7ac571e506039bc6e25d4b0e51a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\1123b253-f89c-4b10-ae48-e8e40dca860c

Filesize
982B

MD5
1c23731a5da20c695746b39306d57918

SHA1
cb3044c36efa99b459370ae4fb8c1efcb5895a4a

SHA256
4fd2803c3aff0767c84bac5bb2a070768425afba8e1a34c82bf57c0b335b4721

SHA512
a5d19821349595c310f436e7b29b01ea9fc7f583b1eb00244a3863cd77f06a31156a434002ca2a4b0493a49afd14a58462874ce382fd49d22b6442a113774896

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\40ac8f4c-35de-41e3-90ef-ff19d4fbb922

Filesize
23KB

MD5
52e9fb2b6d9348e25853f050ee8f9c22

SHA1
f2d4f38836472aaea252e3fcba630fd8296071a9

SHA256
d113ec589ff30bf4a0ada2b769c0522fbfbda076ef203d13c0c8746f5115efff

SHA512
0f90b7d761b2d55e80d00071d4ab695a84604d30b88364f5f98d8e0066860b4e78e53a90108cbe293e7d2e2f80cc20009b99a3c16ecb758c875691b7b76cd9d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\6e3e021a-28a1-4f82-94ec-050170f52180

Filesize
671B

MD5
5faca520a46beaae3a7e166496b75769

SHA1
e6803ff3ef3b59a21f30cb3acfddb855589f78ba

SHA256
924217889fc1b5afb5ffc8b6f9b3844f0bc93b7122d1cdb9662079517700bff3

SHA512
97c13edddebc1f85e2890335d43ed905887685ec5d63ca16f4f0e0bf8b9f03256cba9e98c811aefa16dbb6d483823c5f4404e451b0cd97d706c73ea51277c4c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs-1.js

Filesize
10KB

MD5
fefe4d0b54a2cd4a686b42ab6f297402

SHA1
ef669ae07308179d70145f16f68a0a899191ef32

SHA256
6a1ec2969cf740cb03a4aaef5a092c017aa23d66a22c316c6671865dca8541a0

SHA512
96beee19b1493ae42a605fae95dcab5144159e27ddccb5abd1e7c85f96442f4deef92d7a9256455161707cb6b52e909c8c62e1c107075a48e800e97d8bc13fa3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs.js

Filesize
10KB

MD5
0437b441b5cf11fc76ef2eb3d2bed726

SHA1
15d3720c33913db11bc9514f98f45351e405d5b5

SHA256
d86f4c37221c5f50f50495ec1f17230ce6775415f42b5ebf9bc8ff733140b68a

SHA512
0978e264940870346181542e0180c6f4b34f910bc39838d6f3f0a2ddf3f41813a4730b5548a92da46efd09e3cbb8f64bb40b7aa8c0fe3f022f33ad7fa0ab21a2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
7569851d27c4e32b09b2954200c1bf6b

SHA1
1c2a83160c205c11c73a620408e52ebbc8781652

SHA256
2a62d4e72c0c0d9983584de085d83d5032f099a0c2df53f29ff42f5988cf3879

SHA512
6678925c746bd947863976cbff6ad9aa43e1b3e367613266e36b3111b72b260d1a044fa48f0b0a3d2e5ec0478dc79210ac95b0d81a69406c560349d0dcda8961

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
f45b75ad9bf6ebbbaafe97426d93e7eb

SHA1
a0917012e22a3913b02450566aeb5fb36674d13a

SHA256
4198e8c9365e8a7295d63d99d62bb5ca056429474005f8d9f71dd8bad9dfbef2

SHA512
2febb37ad9a1bfe8700e0177124f571d3c30d90a369f91d699df9b0afead5ee3b7d1531c6c24325c682f7666cfc0c0a8c913c4d01a1a720eaa202bbb7d5df396

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
4KB

MD5
a22c9923ddbc01ed2da02fe5f5a18a6e

SHA1
e6fc61c19e321e124f41145ec4fe60ffeef6be08

SHA256
11cf92ce5478447b8d78d7843127548192309d2d0c9fc892c0bcf67692653395

SHA512
9bb1b054eee094321014d99465a1210f13111092cdd5653311198bc9333ff5b46419a95180fdde19c662101b1df53740c62eb5aef8dc32b7489aa2d6a8c158ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
73b67ee5fa668534230894da217909f2

SHA1
feeaa615189ec94b87ba8510f1b60374eb95f22f

SHA256
3c3db4b5b51daaef5d9af157105476faf583fd56dc530e8c1848ad97fcd6847a

SHA512
afb401fa9921eedac7e53471396f40aec9a03ffd02b8ba5cb566836931e5b3c07ee133cdc9f27309d2f80f014b3101869a478b2133ebc0e8c6e18d8c2927448e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
77e470c5d60fa80bdccc60fb571e3bb6

SHA1
393df3f41765f063b3f46046759e874b696ed2c8

SHA256
d6d865d0a6d197a6330ae9546dd7124489666936a69d48a48dd7e73610508b71

SHA512
a56e04e09ed907da6339310a3866afc373752610f10639d0a8f3615fcebc12079633ef83f45026318850a4f0324de0c9d8db0cb73a55d801ba27d4028eea514e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
65b9df378c6048eaa373638170c55848

SHA1
d109fa5f9372135e74dc6597ab5930b2cc3c8039

SHA256
7a3ba683b25d3d5521f4277fba293004a4af820fde6348e0301d36f70bc41fb3

SHA512
90cdb31f2b5e019a3b5d3a8ab595b0327db364f4782f574117346bb8cadf0ec4070686191a9c62ff62fd641c38dcc37d58f6722fd122dc291ad0ef8a42b6aa2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
b426f99713d6deba3d341809aef2c2e4

SHA1
3dda101fa32199a60fa3caa5d6236b53fd3bfd42

SHA256
c4aaa4be5ae15bf925f589c65ebd88a406400406c26ad9df713dfebca98e8f46

SHA512
4789415a1cac140b873afea79c0741ad1a19579368f339ed22861688a58baf96f044d6999fd4100302dfd5e8cf069090d3ef992681f78b3693368fa2d97bbae7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
9cdcf83b43d81ac01369bb353061fbd3

SHA1
7c918333dfe6c1417d6e5e698664f57da8fb5426

SHA256
d598a13ca9331667ddb9d36e07eda3ab641cf687d2fbb2587c780d2e6e53ea6d

SHA512
5351df306991212d9731c970e6fdfdb61f15ac1807eb3fe17f9cd34ec35529912254951969dae3d7e3eec429931b5c9f6cf015cc1b94da82e8dcca8bb3c44f7c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\storage\default\https+++www.virustotal.com\cache\morgue\219\{cbd4450a-c4ac-4efe-bebe-b9da077b90db}.final

Filesize
50KB

MD5
5dfc1d8e37280885d27e8267aafa32b1

SHA1
b3aed5ded4341ee77cb2a9446cbcf13ad50c162a

SHA256
4e6b9f01fe4f833a68dcb8c5d51518d9179c57b5d53a602e1c51cd22feea947d

SHA512
2832ffad5db7c55bd0f0040882709d6b16220802bb39c7426ef26d9b446dbe34ce01deeeb4a198c2b9daa77bd173534d24abdfe3e12c1a3d08d9d36afa622cfd

Download Submit
memory/836-71-0x0000000000920000-0x0000000000976000-memory.dmp

Filesize
344KB

Download
memory/836-69-0x0000000000920000-0x0000000000976000-memory.dmp

Filesize
344KB

Download
memory/836-68-0x0000000000920000-0x0000000000976000-memory.dmp

Filesize
344KB

Download
memory/836-72-0x0000000000920000-0x0000000000976000-memory.dmp

Filesize
344KB

Download
memory/836-70-0x0000000000920000-0x0000000000976000-memory.dmp

Filesize
344KB

Download
memory/4848-92-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-81-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-80-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-91-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-82-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-90-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-86-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-89-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-88-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download
memory/4848-87-0x000001EB79090000-0x000001EB79091000-memory.dmp

Filesize
4KB

Download