lumma | hxxps://storage-prod-do-blr1-c[.]transfernow[.]net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64[.]zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64[.]zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9[.]eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0[.]VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE0

Analysis

max time kernel
368s
max time network
368s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://storage-prod-do-blr1-c.transfernow.net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0.VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE0

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://tradersneez.click/api

https://impolitewearr.biz/api

https://toppyneedus.biz/api

https://lightdeerysua.biz/api

https://suggestyuoz.biz/api

https://hoursuhouy.biz/api

https://mixedrecipew.biz/api

https://affordtempyo.biz/api

https://pleasedcfrown.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
2884	Disposal.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4984	tasklist.exe
1472	tasklist.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RecipientSale	BootstrapperGUI.exe
File opened for modification	C:\Windows\ItalicExpress	BootstrapperGUI.exe
File opened for modification	C:\Windows\OverheadScore	BootstrapperGUI.exe
File opened for modification	C:\Windows\SuggestionBanner	BootstrapperGUI.exe
File opened for modification	C:\Windows\NeuralPk	BootstrapperGUI.exe
File opened for modification	C:\Windows\ReflectSupports	BootstrapperGUI.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Disposal.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperGUI.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0 = 660032007c20be00365aaf8e210052656c65617365422e7a697000004a0009000400efbe365aaf8e365a60812e000000df06000000000400000000000000000000000000000000000000520065006c00650061007300650042002e007a006900700000001c000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000050ef5e839818db01ff387caf9e18db01868ee979e86cdb0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0 = 4e00310000000000365a8081100054656d7000003a0009000400efbe47591749365a9b812e0000007de10100000001000000000000000000000000000000a5fe0001540065006d007000000014000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0 = 50003100000000004759104b10004c6f63616c003c0009000400efbe47591749365a02812e0000007ce10100000001000000000000000000000000000000fff029004c006f00630061006c00000014000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0\0\NodeSlot = "5"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1 = 56003100000000004759174912004170704461746100400009000400efbe47591749365a01812e00000069e10100000001000000000000000000000000000000fec635004100700070004400610074006100000016000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0 = 7a00310000000000365a6081100054454d50315f7e312e5a495000005e0009000400efbe365a5981365a60812e000000421901000000110000000000000000000000000000003d211001540065006d00700031005f00520035046c00650030047300350412042d007800360034002e007a006900700000001c000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\1\0\0\0	msedge.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2908	msedge.exe
2908	msedge.exe
1856	identity_helper.exe
1856	identity_helper.exe
4760	msedge.exe
4760	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
2884	Disposal.com
2884	Disposal.com
2884	Disposal.com
2884	Disposal.com
2884	Disposal.com
2884	Disposal.com
2052	msedge.exe
2052	msedge.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	tasklist.exe
Token: SeDebugPrivilege	1472	tasklist.exe
Token: SeDebugPrivilege	3768	firefox.exe
Token: SeDebugPrivilege	3768	firefox.exe
Token: SeDebugPrivilege	5564	taskmgr.exe
Token: SeSystemProfilePrivilege	5564	taskmgr.exe
Token: SeCreateGlobalPrivilege	5564	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2884	Disposal.com
2884	Disposal.com
2884	Disposal.com
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2052	msedge.exe
3768	firefox.exe
3768	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2884	Disposal.com
2884	Disposal.com
2884	Disposal.com
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
3768	firefox.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe
5564	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
3768	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 4860	2908	msedge.exe	85
PID 2908 wrote to memory of 4860	2908	msedge.exe	85
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2684	2908	msedge.exe	86
PID 2908 wrote to memory of 2632	2908	msedge.exe	87
PID 2908 wrote to memory of 2632	2908	msedge.exe	87
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88
PID 2908 wrote to memory of 3604	2908	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://storage-prod-do-blr1-c.transfernow.net/files/2025-01-18%2F50881acb09bfe9169b09851e682d9750%2F20250118d1daVVAq%2FSfkyIv%2FR%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip?fileName=R%D0%B5le%D0%B0s%D0%B5%D0%92-x64.zip&bucketName=tnow-prod-apac&bucketId=6713bc8a-6b2c-4105-a432-4ff791c2ab89&size=12460685&singleFile=true&storageCache=true&x-amz-server-side-encryption-customer-algorithm=AES256&x-amz-server-side-encryption-customer-key=qX8L58lkXHtloqHC2VoqtciGSfMgTJBrZYdYl%2BafW3Y%3D&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiL2ZpbGVzLzIwMjUtMDEtMTglMkY1MDg4MWFjYjA5YmZlOTE2OWIwOTg1MWU2ODJkOTc1MCUyRjIwMjUwMTE4ZDFkYVZWQXElMkZTZmt5SXYlMkZSJUQwJUI1bGUlRDAlQjBzJUQwJUI1JUQwJTkyLXg2NC56aXAiLCJpYXQiOjE3Mzc1NjE4NzAsImV4cCI6MTczNzU2MTk5MH0.VfVxchBVaNcA5E4sYgslQ-LyozAYQsOCdeX8R4tUEE0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1efb46f8,0x7ffc1efb4708,0x7ffc1efb4718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,3136008162740211154,13122950777356333167,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:3020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1812

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_RеleаsеВ-x64.zip\README.txt
1⤵
PID:2700

C:\Users\Admin\Documents\ReleaseB\BootstrapperGUI.exe
"C:\Users\Admin\Documents\ReleaseB\BootstrapperGUI.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Re Re.cmd & Re.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4380
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1396
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 340917
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Claimed
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Regarded" Biodiversity
    3⤵
    - System Location Discovery: System Language Discovery
    PID:464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 340917\Disposal.com + Violence + Above + Purse + Porcelain + Imaging + Zdnet + Photo + Facts + Ipod + Selling + Johnson 340917\Disposal.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Single + ..\Certification + ..\Wikipedia + ..\Usgs + ..\Loving + ..\Prophet + ..\Registered D
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\340917\Disposal.com
    Disposal.com D
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2884
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:844
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f4c3fee-fe73-4eb9-840f-1fa004ceecd7} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" gpu
    3⤵
    PID:516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc7fbf1b-7978-4dda-b769-492de75006e1} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" socket
    3⤵
    - Checks processor information in registry
    PID:208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3204 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a986e2a-54fd-40df-b939-66f0056a249b} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4140 -childID 2 -isForBrowser -prefsHandle 1164 -prefMapHandle 880 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9d323a8-886d-47f5-9fd0-36525482a289} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
    3⤵
    PID:3640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4916 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4908 -prefMapHandle 4904 -prefsLen 32348 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c5d9187-1936-4390-b877-acb212464808} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" utility
    3⤵
    - Checks processor information in registry
    PID:5572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5052 -childID 3 -isForBrowser -prefsHandle 5092 -prefMapHandle 4144 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c2921e1-9006-4d35-93e2-e6ff26f4e84b} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
    3⤵
    PID:5904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5060 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5372 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf305d17-417d-4a94-bc54-7685a07c6ab1} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
    3⤵
    PID:5916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 5 -isForBrowser -prefsHandle 5560 -prefMapHandle 5568 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1248 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccf6e42a-0838-4834-b278-74f40d63c213} 3768 "\\.\pipe\gecko-crash-server-pipe.3768" tab
    3⤵
    PID:5928

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
504B

MD5
72672a734333e61780ac6b578f78adad

SHA1
3a7d5dbe3653969105f109bee9c925aa2a73ff7a

SHA256
924caa2b89b7184bea7d8a40a9f616a6bfe5798d240e7f1dc20de6a486824a02

SHA512
7649865074b7ab97753ed445f4c3c37587eb9b8ff49707b7f3bcd80317c8e18e115547eaad170e11a749295fab76822791f90857796940765cb86b2b059b32c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
206B

MD5
01c773943215504d3c9aea332c78b3d2

SHA1
f9c05c87d0a1326417549c2a272c569b3a24b001

SHA256
5e6fba68910f4691120cc0713b80afaff3515ee0a26c891d5f9c9ce2960331a7

SHA512
71b180472a03b9e03f6b3f064407d88b957904a0fa2abf5efd9d16705187c9a0526483eb90f96b9090b979d9f38d717dbb2042bd19234e54f61341191984d57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
666cf8b3e41404ca80f3a8e111a175c6

SHA1
f00fb03079ad03085e4e11f8564d3a9f0023257e

SHA256
f322224a8dce830b116c150f315ef8baf5baa99a42facd9d721ab7c93f40e88a

SHA512
839a3aef3d8475fcfd8df509995366b8e2fa7f93365111fedb07caa67c3ede38065cf283eca4795d277fdb0167376d0b08edff59b138d8e3040a521437386e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2b4f28dca9a5ed57d7626008ccea72fd

SHA1
acca102bd1eb0eaf83227e372805a6ec4b3b8cca

SHA256
299ef11afbe405f2a7a43e4bb52de4141478e79439df4e1b09930544e5878138

SHA512
f9965a3ca8c60cfc568a44831b4f6ad120679b9bdbef77d7f855c1f51e1c111c05087d2ea3097683250ce64212a2e972c22e13579f0d005f6706cde9102bd254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b556b4faef0e173baf7af52ddf558932

SHA1
7044d809033457b16ae99e29a28306a0621b5766

SHA256
e6b40e793de576149eda2c2971ad9ac070068bbafb6f13f2b0e71d2c9f7da214

SHA512
eb4678b98fb7a59304f49ef91b4fd5a70e379d7e477edad040a56c7c734ea5dd698fd84368d79a7a9aff025a458a433e519f696e5edc7667d5d7e1cf3d78295e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
14069d671f3421157fe15f73afe8329b

SHA1
efdd0897b5b4a4f2b7ab9713d6f146a1560cd15a

SHA256
0fd85b4b473887689d94dcc6a54fd2e7fe6dcdc9428df29beebbf92d92d96330

SHA512
cc415476fee7fdbbbfc2c40a6f3dcd1f6994f35a58b9f4b06e37ce85a694e864cf9af6d4432d9d98a0e9493d1b17deafbc17824fc532edc141fc333f054d6731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d44d5b4f2f1423c80974d2256d26895

SHA1
a9e4a449883cd968278a99d9be0c85c297d285f1

SHA256
e5e6f8f859622257f266ea9b8b482d6436aa07d1f1e9a7ea02d069152cd895df

SHA512
6014b5db4a12b464c6cdc9cfdbff14983133f296d90f6c68024a82c854b2531b328bfed5510c27773a945005a3abf037422fb58a9d3fc40d42f0f23701f80a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d39286c2a085eb167bc5487df4264178

SHA1
8cad183c90fba00d5fa53b20a211b9db9cb70cc6

SHA256
83f37160574548cbaefa6202d4658863be688b790505c41b23c361809ec0e319

SHA512
bb5342ae5fde6e757ac006818fe37a8aaeefd136d3576112a63d91a2c35521f98f5f712b0933780c53d50bf8fd2698eb1eb79bf6b6962e4500003921f2bb80d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1a183ba15ebf19425089be78ee5ce4b3

SHA1
ed59f521fc1084f83d7aedc4b29cadf6fc805e2a

SHA256
45af109f0242508a0b36461d22c18f8d0da17393a252e4b546836c88ffa09eb3

SHA512
19e846c21150b73dfa969d9b360696e0b0dd37a1658e3bc7fc3e6838ad5bd301ffa285d2de23d71abdeabe63de9fe6a640793946118dd58011c8cb45d7de1ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
89f65b545cc9c9e4127ff27dec46fb6a

SHA1
ef175e5cc2396729c573ee77bdd402789573eaf6

SHA256
49f98c4ed5eb9543455ab8779b9cd89f2f86bf2bd551683bb40a900f9d4576da

SHA512
6f869edcf3a2a0f484e0331033574e6b14db0385b4c5f7a6f7a66644212e8663be4d3a7a985b68519da5924ac9bbd3607f71a5f0ea7608a545ba6bc2f971f388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
11df15ca4e9e78d5035071c4cdad8121

SHA1
79b26450baf3837e50d14f4546dcbc4eec232ad8

SHA256
231c609ef84174b2bd4426332fd1a2a19525124e967bb9ba6f22dde9eb8844d6

SHA512
59aca5cfd7c9c134a0fd84b511cdb913432c9e6cc6f4e64ac96673f80523632028b134d18eca1fa812cd1a90f196d2664615b6a4d2871a45bb88e0b61e961008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ae8fa.TMP

Filesize
201B

MD5
bab6b5a40d3436c0d60b0398cfdd5873

SHA1
f32e63af0d3269d01e796dbae995469f6f9ff794

SHA256
5f0738b6b0b8059efd2b59149bf047cdf6c204969fd7e398b0ce79dc63a708c0

SHA512
ed5fd7e7840e5db11dd10e65bdeaba8a7f5c118ab0fdbdfa7e43f37fe85d1cdf5da1dc19685853bcf7288988c50f8d9e434a92b8ce4c1d81b836148568c9e54c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a824347e47fda05cd602a7fa23c7f716

SHA1
34758ca7bfd290ce830a8b538c738a6850fbd860

SHA256
91d8a03900185b7bb49bf329e43a897496158528b15eb7e9b308851b4c255bc3

SHA512
2df07a3a47297287401ce2aec3472f5c7513a22e1324ad784b77c155c11af06982123a291d2d457ddfe3504dca790ffc04b0d4e4361c7a7ff8ba8b3931c7ece9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8f9756294ca1365cc86c88cc375cfee2

SHA1
d4a0f7ca9bffca56ffb60350f69280292aec5841

SHA256
feff9264ddc7cb17b41c29dc9780f5ac04b636b909f40ce53f2e5561b7c50116

SHA512
5c6e10c5bcf59a966c14c2dabb30923e2b3fbae1f0228f857630afa4819edd50709f8d51eee3c5d74f28bcd8fd60a204315be914b4a39db80ec70be44ad4b77f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
988a8a5f3aeb2f4801d0b967720dc62f

SHA1
6bdca66ea809b8eb9d0537e6bb19e214624d1e71

SHA256
ff53c8265d5d0cddb8693925b144a986e075a9bdcbb1fe0d0333edecd5d9522c

SHA512
6d705c3985e2a5bb9f2df2e80b31e892ddf015624ed983aabd509bf092dc827e1fc2aa1ea28e94e22f4e0b1057f787acb3cd8eaec06ffb1d48b104412ce30aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0253b845bf6accd779915135ebcd761

SHA1
61cbe21b2f14f84c22de4a0edc739e45d867fcf4

SHA256
07722af8cc90476a782821f20e80a7bb066f1cc7c6c17a1e7ddf69c879c4ab41

SHA512
9be37045dd7c735a6d8b808345fdcff1644a6da320fc8f4d4125984c53f83381364c283f504c23d5e3ff6e333ceca17c69b72237d4c8695e40d10b4117344f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e9f83dbe413b19ab5931f3a907e16ec

SHA1
68f9493060f5f18d7d5c2288662cea9ebb56127e

SHA256
e9b10f31bdde25beb6ffcfe8dafa039120531243eb0145c1a72b70ec8593f63f

SHA512
f1192341bc030cc1023eecce4716db418efa60b725317265d7e18a51386c792afc3f074ca5280c0bc22caaafbc5211a60979141d246711e4767156a6b463eef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0939bbae62c4f290ba7a8861f8be39bd

SHA1
5d2c66e20c2a662caa3a70e53451d11759b749c7

SHA256
a5fe60038050e657370336fe02d3b6827fa4b183c69ae64a4d6ce059a18f8469

SHA512
21a1e121f482f77abce4f592e06837e4c30dbc55ed735d2bea0d41a6210212d0434165a1962fc2252c6d4a6e14b24136ee44baac6727a9f8d17ff42037a7b37d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a932c466-07c7-4de7-9f39-b03a0185d9fe.tmp

Filesize
11KB

MD5
17224f4a22b3790e63f5d748b07233be

SHA1
97737dd0242b714c1908a8b1e66b832697dab2f5

SHA256
e0df78fbba0644c6adf77fd492b21a2488f84e8c28da4b1ded562759af838e18

SHA512
fc784ba16fabae1f568d82a25e22970bd5e305e011bdc5064f75ecfb0c5b44ff74fc7faa8384676ca4ee91ee34a865b0e81933228cfbf212f24fd8f4d6c23500

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
a21efe74e34e451fe8c9dff7da62b14c

SHA1
f21dbba3afce381ca790f997369f7970a27662c2

SHA256
d9e20b30006f181c0d2fb0d85f340c66a6259e92a0b4aa66e5a356b8ef5df376

SHA512
a7158f03fd7f6356bf8a8278fd3e121c9d7e7e308e894db0e050d54a36816cf2047962c9ef7240deadc79d41bb653b177bce6a714b97fbba40293b5d5030026c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\340917\D

Filesize
496KB

MD5
17dd7466297f02a8dfd1b1d3b1446531

SHA1
f24b5d9ac103fe1d6ac109c7b374401ec042771a

SHA256
e5d5315fc8dc081dbe78f185682759ca7c8493885d892131942f49e5ab411f14

SHA512
01f5483f5505776031a332283c70f1e24742048e1b9164b6f63e6b7adef5802a879782c766acc7c145c89620152779edb3b7ef9f47ed83e1503bae313d1e389f

Download Submit
C:\Users\Admin\AppData\Local\Temp\340917\Disposal.com

Filesize
145KB

MD5
1e0d955fb192084c15c3e53ef296f1e2

SHA1
e2f545ba5fbbb4cd18363dca6f8007521afefea9

SHA256
3e06d95d13ac2415fab7eed85b22eda677af960bffbd31850274840bd2d91955

SHA512
3267d139915eacd335056c9e0a7e6c5810fd51a0e64a9c615a9699f58fcabc82a6917ab8e5b4be56c8b42c7c205c3d5fe4df7ead2aabf48fae7b5cf043dd07a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\340917\Disposal.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Above

Filesize
59KB

MD5
d88e04f7a23e77ad1be7d45352d1991b

SHA1
c187f58ee4ee55f86cc9e9fb884e4648621ac9c3

SHA256
ea7713f92c5e61dce396c08c527bc0820033e9344e4f21ecd8f0455da1a9de12

SHA512
6ec1db2eb816f5ecb823f3044a1c8e990b8654f0cb132c91508a68f45cf78cda89e64cff8c3c61daf05f53e55c9272b360d9ca170378808cb296611f499d9ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Biodiversity

Filesize
1KB

MD5
4fe6f5461c7c40db33d910a12fec2a79

SHA1
aa2ee0de4e71001550a3945081882d4a8a1c2d59

SHA256
b004161a9eda8d8aa733a38062146c9bceafc32ba621a758718605506010aedf

SHA512
e41e3b7cac3c86b17ed5c535709b62ac2889f8326f2478e70ebae80d75566e1516ce2e603461cb550b1ad226894a7f96d946c42ec0c571627cfbc88accb4b557

Download Submit
C:\Users\Admin\AppData\Local\Temp\Certification

Filesize
91KB

MD5
abb21134a4f9211d2f28a8d2ba0b1fe1

SHA1
a40a8360efea23fcd9af117f26768cb3d7265ada

SHA256
b44e36ed9ff6a88adfdaadbfdb8691bc40606d33f15799810962e2619f80c466

SHA512
e48e7efd94916867f8707f3a6b69b3de8373664ad6e31bd25b4ffc639df3fee5bcf9653018a65fc7f74e4342a73721ad2617f12abe9ab4a8ae37ed37b9ad3337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Claimed

Filesize
476KB

MD5
20fc38827d4eb4452035cfcfee2d8c14

SHA1
aa4ec6a834a732dabfe1e068b05bf8b5ac9412b5

SHA256
f2f03b313f4007bdfac6dd5bb15eddeeeeff5c40553acc31d0906fe08a9c275a

SHA512
0ea8b707989dd684944b3f83f94eb5479414323f2177d888bebc2b104238f9f0f353718b714737667bcd9ec00cce52aa248e9f639b0fbd1ac4bd3b9b5e8236a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Facts

Filesize
57KB

MD5
60ffad7f702c52c0335984fba06dca2d

SHA1
11100fc0104616b4c79fe10e71694d5fad766a58

SHA256
e7bbd8738ebde9f732b70120304516a70e75ae8448fd7b135941888c435dab28

SHA512
632a5660ea545994a17f4643bc74beac19509676a16ce38f31cbc9defd0f4987b64a13fa3b25265c586c6added16c6d7c6a46bcd9238514d916d902e958284fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Imaging

Filesize
135KB

MD5
561abfe4a979b2713e00849ef7b5750f

SHA1
7894820d54b3bd0d0cea927da161e65d408abbb2

SHA256
ef840c0c3741162a4055f501a50535dc9f1ab3f1a2adc3ea363aebf3fd0a5834

SHA512
bcf4670f8889b25c4e7e9b5e2dc567cd952874abb53ca7b481cd90216254a0a80d5107f3317962440f461b0fbd6bb89d4d3c4d562e6bc6270d8cd0fe51fcc8ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ipod

Filesize
75KB

MD5
2eafff2ca929d25609899da5168732ce

SHA1
ee838b4a882cb68de828bfdd31013bebbcddca3c

SHA256
18757fe406aec7ed2c45e2e380ce3f1bf409fba01ae4a1a195958ff69718e1eb

SHA512
6b471e93d739b46e2bb42b24dcc22b71d43b6ddf0e4761c23d451647bd9a39c2be37cb35690e446391c045724459db5a62d29c0c6b42ab8797a02784581ee1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Johnson

Filesize
43KB

MD5
e254802b09d9b8bd3847a0df8a078325

SHA1
44490d529dcf461b0d6c6418a2059b0cc6557afd

SHA256
bb046cff9ed9fc400735abf70c05ef8a1971dd4df24b6fad7995d98881de5ed2

SHA512
128736e13f9311cdbf2d2aa2e5b65a8117ab04a40550c232be60b424c608980bfb337730cc29153db18fe06eaca48b6e3085439588568545c27c3848f67f03b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Loving

Filesize
74KB

MD5
f31b4023aa01fb113405a331278ab9a9

SHA1
393714a5765d77cf96b8642410eb2bba0cda5313

SHA256
169d4ad56c587292db439bea272a5f0f212a509c0ea3946136cd82d3a4512cc0

SHA512
0b28dd7e7f6718993453df48c712e34cc9ec0bff5eda9d152052015861f9cec0acb72b34715bb2d6601683f0fcef3ecf8563032b6cf8dd9b96e5b01992456fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Photo

Filesize
65KB

MD5
1f34b509444ddafdc5db392355d6030c

SHA1
0eb74a71e7f9d032202907e53a5eca616f0854eb

SHA256
c3aac528b8ce09f7fa8a8f093bba53a5f931c057fff82703cdb85dd93df2d07b

SHA512
21255d420fe6d5dec4bcf880e208df1a39875b3d404c8892f07c228edc6d20431a95ab05c63418f9b2cd15a9eaac74991b758d5869345b86abed69dfd12772a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Porcelain

Filesize
55KB

MD5
89ea696be802aaf4204fc6c0b76afcc6

SHA1
9ede6af57ea48370afc71afaa3adbfef5208eab2

SHA256
899437f29213e6649b4c000ee9827e3cac3bd8028c7a2eff28627ab9d88e827a

SHA512
748097e7f81658cda377b09559e82d00ffbdbed057188336aedfff156c172604b2d9138309b7d127ecaa706f1373ada29f491ff0a3e6ed9ee87bf44717172edd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Prophet

Filesize
67KB

MD5
cd937d6d4d1cebc84b5150d1a3d4db6d

SHA1
7bbef6be5454bf941127e3d0762247e3f918b2f0

SHA256
66a998c2b5862f22b098f00ce1ae1e08e9b7298a9ec57aa8db3bf2db253a3a81

SHA512
1f939a423cd0e731db0d9f88fe3cbe28c5de067403fe6d9b8f5036fe36f97bbce712e4fa0d68196b712fe4d5d5a73d6ee9624ada0598b81effe7178f7b213d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Purse

Filesize
141KB

MD5
fcf10aef7e06666b64bd2166f710a8f4

SHA1
4168d616038689401e6aec4d7918245ea7e95652

SHA256
ac89bff5c9d9af8fe4506382fd7772e1e464f7904a554e75f34963516a848bd3

SHA512
295269e5123347ddf10cc2212e569a7cb389d2a33b3fad2dc7327ab8bdb8f956a7ac7f6592489a47889f95b2126bd63e664f28ca72a3c68e52481905e55e796f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Re

Filesize
27KB

MD5
e4b460462746b77bca3afe76fdbf0810

SHA1
38e685630a8ef761db8bb8d0fc269dc7ef878dbf

SHA256
eb37f2aee73e6060a6eb96c88b08af0b4f273f731b72e99b31e075d4418ce0b5

SHA512
f6f8692a053203434cf30e6f8b8d20a1e56c83112775a160d90ea47beaa3b8cccedcb09b51f1b9fb28a4d048d46c59fe6d88d883ef9a0133ce9f7359ff5e6557

Download Submit
C:\Users\Admin\AppData\Local\Temp\Registered

Filesize
57KB

MD5
5ae9352835d7e57259848104d413748e

SHA1
565c5865e233cbb15201eb36fcecf0f1b9f1fc51

SHA256
ea1ec57ce0147188b91ae6346063e60dabce991f09f968ca86e98437b9fbdd2c

SHA512
1aa9781503f7a7f5f3504096e5dcdf00f3ca2ad702e93eec9147aa92a09f1e955ffc41ba4a6dddac73332433b35853d492a6abcf20aa1980ad5f81f2579487c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Selling

Filesize
120KB

MD5
ef6c0c4a03942b898c1345fc5e2923d1

SHA1
802a01cee96e04725ecd527c5f9426fca7edbd35

SHA256
fc4c66f7e940be137583a37a40c71ddece824dcb2c945049c56d377f869c8266

SHA512
98cd652ec23a7acac03c5097e6e9cc41003eb7146e7eaf21db7ae36de30d1cd6e8cfaceb1978f18e3e446944d776080481eb45e71a1ffd1c52cfe2cb1641ccaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Single

Filesize
67KB

MD5
5349a477a2081ab09b1f1aca6ca572dc

SHA1
57968a903f92ccacc6e7d577e6488d2894e3877c

SHA256
b129d35e0906df8b0e81844992d7a663073110a1f60d51e7c1e8995aff9f6cd3

SHA512
5806e022a63ea9586d3fc3243793b6a604103b856ff92bd31a396334756df9641dfadacca7b62562f531110715a3b8ec28aaa0c5f0309dec33ad6cb8357bcc1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Usgs

Filesize
70KB

MD5
9152d897abfc11e7f47f4dcffa4e1dcb

SHA1
bac18a4e2819d4ecf18dd70d5e36638a58387ed0

SHA256
a5ef2e4a4553670780a5d4fbac1f4ff7ad2232b5eefb343f6548a1b68912138a

SHA512
5f23307e7c29ec2d9cfd0063b9dfa6552433e90575958a860c76f11302a5397e37723f65d906d7f3c92ef9843587fee4b4f98a96adf5d6dabd4dfc80afc351ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Violence

Filesize
85KB

MD5
98624849254fb1f0653da5db882e1560

SHA1
5c7967add2247827f8d8fcc4f7311a66a4a36204

SHA256
0656568395a1b68f778098b6d3519bdfd86dd9f5a39da10a5850b2b17545f139

SHA512
27dc9d10e8c3113f62028435ddc51b9402a8d507ea1f43a88a300374a722ad20fba8c7877bc483a0f55deb0cee25e3bb64d54c32cc032e4d1384a1626d8e2fe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wikipedia

Filesize
70KB

MD5
070190137c2a7ee0e964e261ebd9e25e

SHA1
3e5230f125ada287e1ccd9e52733539762cdac7e

SHA256
5cc23023cf6ea445764a4b39ffc0a4ef3ba9099254eee86b1ad51db63bcd5233

SHA512
547daf63266a12833e5e370eb606814a01b89c266fa3fce9ab47c686a0929e91d9b515ab3d7cf41954ccfceffbeac22e9756f298aad4710d01c0ab747bab9e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zdnet

Filesize
88KB

MD5
ad758f1e2bc2c34ec6c8a23df9236746

SHA1
48807f2ec69dc2cd96f78a7809d99f63853acb81

SHA256
c806b7ae24975aa2b7c4635d4c75781a97092e820946c0405630d7441985f3c2

SHA512
b17ba342403e16ecfde952dc5f482ad31c011375d3791046fc056170001073c169101e2cd37939c95cdbd19ee785b9ae53b572daec7a4628f013136c163f73dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

Filesize
6KB

MD5
4885864c3762cbd96d84e67a143dd505

SHA1
7a9339dccbcac55c1ecb8d9a630bb9692156a995

SHA256
bf6381fd7c9b2882329dd88d6af77bcff51999e1438008f4050613b6e2da90bb

SHA512
900f830646588f2f4679265e2978aebef414aa5219b5c7a6012896ee954fd54c3373f8a54fd28246b2ef0f943b475f4e43e0cd23d596744b31c6c9075c59402c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
adc5772bba059e959937ca150999593f

SHA1
2ee3a3c14820e3355edf7c35a6458be17200bc73

SHA256
559238ec2a35925d129ea012f649964c3e4aebfb68be87bda8bd336ffdb49a68

SHA512
f50d51c9b6b78187f2422ee1e1131531753346eed8ff6e32b1218742ee66d606d4c6b37fb6bc16e7f5ac160f543d346941dbb7543c96de4286f4741eceded788

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9e10921ac140af7d36b1c24a55309091

SHA1
f0611356e8e00fa4ddfc07871b42c9c944b2f7f8

SHA256
b743a2851844d260e1663de5ec11adadabc82f97831080186b2d1e332618aced

SHA512
a96ec9400d3f7a7668703b8c5c88bab15a4b798e567987224b37bb8b3522551777765911fb401c4ddb378e5a5721e479c2b9b1f3d11692c05cccb0b0cb22d151

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\0697120e-ccc0-4094-a84c-01d6e4fa15ab

Filesize
26KB

MD5
5a9c4e107b8b68fb5862bd1fda3a6cd9

SHA1
16b281961bef25fe7ca3147133616658294946b4

SHA256
f8044d7d7a22868a25e20e6493491b05c59eebfeac3f79bd152618db06b2d0d7

SHA512
fb16bdfa53b1931a660a59848310615f022fa6ea0ad9ca47e873492eebec4ff64a3e1d9cc399360fcedca46faa7dfae732ea1985398c071a6bacb36fe431f887

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\3d4ab05e-37e9-42aa-ac39-706d4353eac1

Filesize
982B

MD5
9b339a5063028b57d3f15de1ce847dcc

SHA1
dd57805825f4046012daf3777ee4a0130da8b64a

SHA256
8a60d618e3555544dd7682026af72c1b895cae5c10d6544c980edf4b5f869056

SHA512
c8934d011c07f4fc5a971e2c410799147d870b6f6692059dfd138a76dcc76eb43cb18709ca44c3b7364b9d2291453c6c6bfa03584da895a038c5769892e728a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\ff39d860-296b-49ec-b473-19cb004c2791

Filesize
671B

MD5
92ca65e90589c7a65b823acdbcee17d0

SHA1
c4534adb9bee1e474717230473511b38ed68602e

SHA256
3279d745368705e294deb762594cda1154a4af0195705cdc25a4b4b82125c355

SHA512
1647ef5f40f8616b3ba0363791639a875e8554732e71eacd38eff61050101fe12b3261ef2a22ab4347268ca66bc7dc4e5590ced0ed65d7983242c5a14ff72a4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js

Filesize
9KB

MD5
91f0dce209c3105e37a1131ff867b9e0

SHA1
af709a486f11d6606cb3a3379b85c54d1f6ce35a

SHA256
aa0787e989455f351c921efa9231df92738d0df392cc1fb272d5408393acef95

SHA512
26548e746ecb30d4fca60bbe3e36d32fc1fcc9376054c1987b84c91ee4393b43631b7dcbf17fdc9442bf614e45c6fa3b5ae16d1314e87aed202ecd31922bd388

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js

Filesize
10KB

MD5
29c2c66067a76b512a04b4469393d1ee

SHA1
d4d3a7c2db83ba5fc75e1f68ab4dd50f51adcb69

SHA256
d937e06e62e484c3cd81f81f3027e68f42b262474a95bf6aa4a1e36da7561930

SHA512
fde646556a42f734a5cb0fbebbe6f1890931abbb819812c8182388d33bfff3df6bd554ea5e6f295119eacefbb32c5c5263ee776dafa3e3bf4bf556456fed38e5

Download Submit
C:\Users\Admin\Downloads\RеleаsеВ-x64.zip

Filesize
11.9MB

MD5
7f5139bf0b495a08e171c0d353513463

SHA1
c51a1ac3db02c2d09800b33c907fde749a306343

SHA256
322e197be9a437de2ba07ec69b49c164d8c3121f1ceb161e983788407cf760fb

SHA512
9476ad6b0db052a320874dcde162d99e38e89ce6df41833a1426c7304d1a95adcffc34ec847c8afb7a5895130a8693b398bfcb1a372fa7ebd87babb432277459

Download Submit
memory/2884-935-0x0000000000040000-0x000000000009B000-memory.dmp

Filesize
364KB

Download
memory/2884-934-0x0000000000040000-0x000000000009B000-memory.dmp

Filesize
364KB

Download
memory/2884-933-0x0000000000040000-0x000000000009B000-memory.dmp

Filesize
364KB

Download
memory/2884-936-0x0000000000040000-0x000000000009B000-memory.dmp

Filesize
364KB

Download
memory/2884-937-0x0000000000040000-0x000000000009B000-memory.dmp

Filesize
364KB

Download
memory/5564-1412-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1421-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1420-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1419-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1418-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1417-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1416-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1422-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1411-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download
memory/5564-1410-0x00000227B3FD0000-0x00000227B3FD1000-memory.dmp

Filesize
4KB

Download