wannacry | 74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829

Resubmissions

30-06-2024 01:15

240630-bl765a1enb 10

30-06-2024 00:49

240630-a6bg8athpn 10

29-06-2024 12:42

240629-pxbtysxfle 10

Analysis

max time kernel
2699s
max time network
2322s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
29-06-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x360ce.exe
Size

14.7MB
MD5

be80f3348b240bcee1aa96d33fe0e768
SHA1

40ea5de9a7a15f6e0d891cd1ba4bca8519bb85ed
SHA256

74faf334cb0bdd3e9dfab8c323d4eb3b9b089bcaadc7dbd639d9aa93a4f6f829
SHA512

dfb3b191152981f21180e93597c7b1891da6f10b811db2c8db9f45bbecc9feb54bc032bdd648c7ad1134e9b09e5e2b9705d5e21294e1ae328a4390350745536a
SSDEEP

196608:n+/7/fO/vBSVnf+viDyJBwhsCArf+viDyJBQhsCAaIF/f+viDyJBaF9hsCA6EJ0k:nX/vu0Bwhs8vu0BQhsvFOvu0BaF9hsR

Score

10^/10

wannacry defense_evasion discovery persistence privilege_escalation ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Drops startup file 2 IoCs

Processes:

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD32C.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD353.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exe

pid process

5860 icacls.exe
3820 icacls.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

reg.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wbaseltcdk426 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\"" reg.exe
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

165 raw.githubusercontent.com
166 raw.githubusercontent.com

pid	process
5860	icacls.exe
3820	icacls.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wbaseltcdk426 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe

flow	ioc
165	raw.githubusercontent.com
166	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

@[email protected]ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 9 IoCs

Processes:

x360ce.exetaskmgr.exetaskmgr.exeSearchUI.exe

description	ioc	process
File created	C:\Windows\INF\c_monitor.PNF	x360ce.exe
File created	C:\Windows\INF\c_volume.PNF	x360ce.exe
File created	C:\Windows\INF\c_processor.PNF	x360ce.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\INF\c_diskdrive.PNF	x360ce.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Executes dropped EXE 13 IoCs

Processes:

taskdl.exetaskdl.exetaskse.exe@[email protected]@[email protected]@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]@[email protected]

pid	process
5172	taskdl.exe
5656	taskdl.exe
1924	taskse.exe
1872	@[email protected]
1016	@[email protected]
5284	@[email protected]
5508	taskdl.exe
6116	taskse.exe
3868	@[email protected]
3792	taskdl.exe
312	taskse.exe
5996	@[email protected]
1920	@[email protected]

Loads dropped DLL 1 IoCs

Processes:

x360ce.exe

pid process

1604 x360ce.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 34 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

x360ce.exetaskmgr.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	x360ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	x360ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exechrome.exeSearchUI.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 6 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid process

5784 ipconfig.exe
5612 ipconfig.exe
520 ipconfig.exe
4788 ipconfig.exe
5984 ipconfig.exe
5672 ipconfig.exe
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

SearchUI.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe

pid	process
5784	ipconfig.exe
5612	ipconfig.exe
520	ipconfig.exe
4788	ipconfig.exe
5984	ipconfig.exe
5672	ipconfig.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Internet Explorer\GPU	SearchUI.exe

Modifies data under HKEY_USERS 4 IoCs

Processes:

chrome.exechrome.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641385567758335"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

Processes:

chrome.exeSearchUI.exeNOTEPAD.EXEfirefox.exefirefox.exefirefox.exeOpenWith.exeOpenWith.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7650"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "11"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "363"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7682"	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "364"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "396"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "363"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

6060 reg.exe
NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\P01S0N-main.zip:Zone.Identifier firefox.exe

pid	process
6060	reg.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\P01S0N-main.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

x360ce.exechrome.exe

pid	process
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
2868	chrome.exe
2868	chrome.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe
1604	x360ce.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

OpenWith.exex360ce.exetaskmgr.exe

pid process

2220 OpenWith.exe
1604 x360ce.exe
3956 taskmgr.exe

pid	process
2220	OpenWith.exe
1604	x360ce.exe
3956	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

Processes:

chrome.exechrome.exechrome.exe

pid	process
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe
6036	chrome.exe
6036	chrome.exe
6036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

x360ce.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1604	x360ce.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe
Token: SeCreatePagefilePrivilege	2868	chrome.exe
Token: SeShutdownPrivilege	2868	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

x360ce.exechrome.exe

pid	process
1604	x360ce.exe
1604	x360ce.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

x360ce.exechrome.exefirefox.exechrome.exe

pid	process
1604	x360ce.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
2868	chrome.exe
1604	x360ce.exe
2336	firefox.exe
2336	firefox.exe
2336	firefox.exe
5392	chrome.exe
5392	chrome.exe
5392	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

x360ce.exechrome.exefirefox.exeOpenWith.exeOpenWith.exeOpenWith.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]SearchUI.exefirefox.exefirefox.exefirefox.exefirefox.exeosk.exe

pid	process
1604	x360ce.exe
4040	chrome.exe
2336	firefox.exe
2876	OpenWith.exe
2244	OpenWith.exe
2876	OpenWith.exe
2876	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
2220	OpenWith.exe
1872	@[email protected]
1872	@[email protected]
5284	@[email protected]
3868	@[email protected]
5996	@[email protected]
1920	@[email protected]
4448	SearchUI.exe
5936	firefox.exe
4400	firefox.exe
4448	SearchUI.exe
4448	SearchUI.exe
4448	SearchUI.exe
4448	SearchUI.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
4400	firefox.exe
5616	firefox.exe
5356	firefox.exe
4580	osk.exe
4580	osk.exe
4580	osk.exe
4580	osk.exe
4580	osk.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2868 wrote to memory of 3144	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 3144	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 880	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 4540	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 4540	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe
PID 2868 wrote to memory of 2972	2868	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exe

pid process

4180 attrib.exe
5908 attrib.exe
1452 attrib.exe

pid	process
4180	attrib.exe
5908	attrib.exe
1452	attrib.exe

C:\Users\Admin\AppData\Local\Temp\x360ce.exe
"C:\Users\Admin\AppData\Local\Temp\x360ce.exe"
1⤵
- Drops file in Windows directory
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdeea39758,0x7ffdeea39768,0x7ffdeea39778
2⤵
PID:3144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:2
2⤵
PID:880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:4540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:2972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
2⤵
PID:3884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
2⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4404 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
2⤵
PID:4940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4420 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:3324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4620 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:2996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5260 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
2⤵
PID:4204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5092 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
2⤵
PID:2784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:2508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:4404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:8
2⤵
PID:168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4660 --field-trial-handle=1872,i,7969533101795119969,13104644435557718748,131072 /prefetch:1
2⤵
PID:1444

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2164

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6bb37965cd49445887f2c63636e416e8 /t 2584 /p 1604
1⤵
PID:4208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4212

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.0.485774313\1898041861" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1696 -prefsLen 20767 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0e3262f-6fe0-4b85-a2fd-e17ebd3d9f7f} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 1792 1b74fcdc058 gpu
3⤵
PID:4992

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.1.2028021135\2090226749" -parentBuildID 20221007134813 -prefsHandle 2136 -prefMapHandle 2132 -prefsLen 20848 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db1df5bc-569c-44c5-a075-38734785c0d5} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 2148 1b744c72858 socket
3⤵
- Checks processor information in registry
PID:4640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.2.1132289045\842700985" -childID 1 -isForBrowser -prefsHandle 3020 -prefMapHandle 3016 -prefsLen 20951 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e20cee16-48a7-456f-89be-a478a2015fc8} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3032 1b753cba558 tab
3⤵
PID:3196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.3.2090601943\2013075698" -childID 2 -isForBrowser -prefsHandle 3472 -prefMapHandle 3468 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f81cc28b-3478-46b4-831b-16df252b4423} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3484 1b7525eba58 tab
3⤵
PID:2616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.4.447837657\1712616188" -childID 3 -isForBrowser -prefsHandle 4276 -prefMapHandle 4272 -prefsLen 26271 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {726167a3-f378-4fdc-82c4-9d06372f3d9c} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 3668 1b754d6c858 tab
3⤵
PID:1032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.5.1687032270\1818256804" -childID 4 -isForBrowser -prefsHandle 4772 -prefMapHandle 4796 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40645668-9643-4c6f-82a4-dac6afb3eca2} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4776 1b7565a2858 tab
3⤵
PID:792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.6.193348506\235102129" -childID 5 -isForBrowser -prefsHandle 4924 -prefMapHandle 4928 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e510d871-bb7b-48b1-a6e0-f88577bf015a} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4916 1b75484a458 tab
3⤵
PID:4316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2336.7.1265240070\1197505956" -childID 6 -isForBrowser -prefsHandle 5112 -prefMapHandle 5116 -prefsLen 26195 -prefMapSize 233414 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cdeaa4ef-532a-4790-859a-16a28c6412a6} 2336 "\\.\pipe\gecko-crash-server-pipe.2336" 4820 1b754849e58 tab
3⤵
PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:5392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdeea39758,0x7ffdeea39768,0x7ffdeea39778
2⤵
PID:5520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:2
2⤵
PID:5780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4376 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4620 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4700 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3020 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:2180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:4432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5924 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:1972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3304 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6108 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:6056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6036 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:3676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5572 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5524 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:3032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3028 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:2
2⤵
PID:2636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=944 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3276 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:6080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=3132 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5952 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3076 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1120 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=3516 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3508 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:1
2⤵
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1852,i,5084970608120828889,16242783021053114100,131072 /prefetch:8
2⤵
PID:5532

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:6100

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12910:86:7zEvent18992
1⤵
PID:4580

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMWARE-WANNACRY-2.0-master\README.md
2⤵
PID:5304

C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:5344

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:4180

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3820

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 25731719665344.bat
2⤵
PID:4980

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:5908

C:\Users\Admin\Desktop\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
PID:1016

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:1248

C:\Users\Admin\Desktop\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5284

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5508

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:6116

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3868

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "wbaseltcdk426" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
2⤵
PID:5928

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "wbaseltcdk426" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:6060

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3792

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@[email protected]
2⤵
- Executes dropped EXE
PID:312

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5996

C:\Users\Admin\Desktop\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RANSOMWARE-WANNACRY-2.0-master\@[email protected]
1⤵
PID:5700

C:\Users\Admin\Desktop\taskdl.exe
"C:\Users\Admin\Desktop\taskdl.exe"
1⤵
- Executes dropped EXE
PID:5656

C:\Users\Admin\Desktop\taskse.exe
"C:\Users\Admin\Desktop\taskse.exe"
1⤵
- Executes dropped EXE
PID:1924

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Sets desktop wallpaper using registry
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872

C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
PID:5492

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:1452

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:5860

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:3956

\??\c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:5448

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5912

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5936

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.0.1233555148\780826971" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1524 -prefsLen 17655 -prefMapSize 231678 -appDir "C:\Program Files\Mozilla Firefox\browser" - {68dbdd4c-0020-4cd2-8c34-0fbfb29e97a7} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 1620 1df3d9fd058 gpu
3⤵
PID:5668

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.1.1580576845\841084941" -parentBuildID 20221007134813 -prefsHandle 2016 -prefMapHandle 2012 -prefsLen 17700 -prefMapSize 231678 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea13cc80-108e-4b1a-9449-5a6201440da3} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 2028 1df3d62ad58 socket
3⤵
- Checks processor information in registry
PID:5232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.2.609605495\1232018475" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3100 -prefsLen 20286 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b91adeb-8abe-4a4f-a6a3-1f00b7816712} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3116 1df40fd4658 tab
3⤵
PID:5088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.3.1453997099\245634513" -childID 2 -isForBrowser -prefsHandle 3384 -prefMapHandle 3388 -prefsLen 20408 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f6f2c6f-056e-4e8f-b548-08c0846086b8} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3876 1df42394658 tab
3⤵
PID:3600

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.4.1758223490\1921953519" -childID 3 -isForBrowser -prefsHandle 3964 -prefMapHandle 3824 -prefsLen 26868 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3531730f-22d2-4de6-b285-adc53e6c1dc6} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3776 1df4228d458 tab
3⤵
PID:3492

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.5.449070076\2125114288" -parentBuildID 20221007134813 -prefsHandle 4256 -prefMapHandle 4252 -prefsLen 27129 -prefMapSize 231678 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b93bd154-fd13-4b4a-a959-0c0ea9542b20} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 4264 1df432cce58 rdd
3⤵
PID:3104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.6.1252147755\876713867" -childID 4 -isForBrowser -prefsHandle 3592 -prefMapHandle 3588 -prefsLen 27457 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {764b38e6-902e-4d30-a09f-0313aa7ed961} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3524 1df3d62b658 tab
3⤵
PID:5116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.7.1756787155\895253408" -childID 5 -isForBrowser -prefsHandle 4756 -prefMapHandle 3592 -prefsLen 27496 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d0d962d-44be-43c7-94b7-3634941b7d1d} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 3564 1df43f1dc58 tab
3⤵
PID:3920

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.8.223275292\650091305" -childID 6 -isForBrowser -prefsHandle 4860 -prefMapHandle 4868 -prefsLen 27496 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {252ff058-ddbe-4c60-866c-ff5f22d638be} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 4944 1df43f1e258 tab
3⤵
PID:4636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5936.9.1432120203\1835989325" -childID 7 -isForBrowser -prefsHandle 3304 -prefMapHandle 3720 -prefsLen 27496 -prefMapSize 231678 -jsInitHandle 1120 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7220f0cc-4ffe-494e-b2fb-f4e6d778fbf1} 5936 "\\.\pipe\gecko-crash-server-pipe.5936" 4836 1df43f1eb58 tab
3⤵
PID:5824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdeea39758,0x7ffdeea39768,0x7ffdeea39778
2⤵
PID:5176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:2
2⤵
PID:3788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
2⤵
PID:3316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1852 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
2⤵
PID:4564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:1
2⤵
PID:1368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3248 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:1
2⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4352 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:1
2⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3784 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
2⤵
PID:3688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
2⤵
PID:3732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1908,i,16308796277716957498,17853293331268834009,131072 /prefetch:8
2⤵
PID:5996

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1572

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.0.1661125377\1042700566" -parentBuildID 20221007134813 -prefsHandle 1584 -prefMapHandle 1560 -prefsLen 20529 -prefMapSize 233006 -appDir "C:\Program Files\Mozilla Firefox\browser" - {712e4435-501d-42a8-a877-b47a8ba4007a} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 1664 21aa360d258 gpu
3⤵
PID:5364

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.1.1729119649\1424153627" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 20574 -prefMapSize 233006 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59f1f071-79ba-460b-b911-63b42c65397b} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 2008 21aa3236758 socket
3⤵
- Checks processor information in registry
PID:2804

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.2.535189209\1297531834" -childID 1 -isForBrowser -prefsHandle 2744 -prefMapHandle 2740 -prefsLen 21034 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbf3a6d5-549b-49ae-a3b0-4795abbb4a02} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 2756 21aa7141258 tab
3⤵
PID:4984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.3.1330867050\866264493" -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e97722c9-df1c-4d7a-8cef-daf58a5578f4} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 3636 21aa8362758 tab
3⤵
PID:4488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.4.1338965945\634951009" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3776 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89fdb167-cf0f-418e-958c-36a707f73004} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 3796 21a98730258 tab
3⤵
PID:1560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.5.1520029979\932904861" -childID 4 -isForBrowser -prefsHandle 4556 -prefMapHandle 4552 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2f394cf-b98b-4d67-a5c4-d1615d855c85} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 4568 21aa96fae58 tab
3⤵
PID:6012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.6.43867502\1110361879" -childID 5 -isForBrowser -prefsHandle 4736 -prefMapHandle 4740 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24a1fbdf-e5c6-431b-add6-68a345289e48} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 4600 21aa96fab58 tab
3⤵
PID:1520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.7.1337400493\567827467" -childID 6 -isForBrowser -prefsHandle 4908 -prefMapHandle 4912 -prefsLen 26304 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {506bb145-62b9-4d4a-99f2-932322d9df9f} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 4404 21aa96fbd58 tab
3⤵
PID:5956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.8.137177478\1187661952" -childID 7 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26383 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aeeb396d-b30f-4d92-8e51-4b7068fcf025} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 5296 21aaa6b8658 tab
3⤵
PID:1852

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.9.567647113\836673868" -childID 8 -isForBrowser -prefsHandle 5404 -prefMapHandle 5476 -prefsLen 26823 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {76cc159a-d171-4bdd-b113-5825c9d6dd0f} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 5560 21a98765958 tab
3⤵
PID:5816

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4400.10.1350503029\863777098" -childID 9 -isForBrowser -prefsHandle 4140 -prefMapHandle 3912 -prefsLen 26823 -prefMapSize 233006 -jsInitHandle 1316 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f0d7344-acca-4304-9078-103b03b84fd6} 4400 "\\.\pipe\gecko-crash-server-pipe.4400" 3864 21aab286e58 tab
3⤵
PID:4420

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /6
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat"
1⤵
PID:5124

C:\Windows\system32\ipconfig.exe
ipconfig /release
2⤵
- Gathers network information
PID:5612

C:\Windows\system32\choice.exe
choice /c AB /m "Would you like to Access your internet connection back?Y/N"
2⤵
PID:3532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\P01S0N-main\Flash_fund.bat"
1⤵
PID:3492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\P01S0N-main\Free_internet.bat"
1⤵
PID:3460

C:\Windows\system32\ipconfig.exe
ipconfig release
2⤵
- Gathers network information
PID:5784

C:\Windows\system32\notepad.exe
notepad
2⤵
PID:792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:3544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
3⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5616

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.0.1826099739\1513925409" -parentBuildID 20221007134813 -prefsHandle 1524 -prefMapHandle 1512 -prefsLen 20949 -prefMapSize 233105 -appDir "C:\Program Files\Mozilla Firefox\browser" - {05aa9dd7-5bd3-4e91-a304-3e104b9d3468} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 1616 1f6108fbc58 gpu
4⤵
PID:5640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.1.1570809441\1700907766" -parentBuildID 20221007134813 -prefsHandle 1944 -prefMapHandle 1940 -prefsLen 20994 -prefMapSize 233105 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {583cf3b6-8ea9-4b7e-a0fd-7c93766b5093} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 1956 1f610536d58 socket
4⤵
- Checks processor information in registry
PID:2172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.2.1674960688\1841936684" -childID 1 -isForBrowser -prefsHandle 2684 -prefMapHandle 2680 -prefsLen 21455 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88268b77-13fd-466a-b439-907d4f658ddf} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 2648 1f61095b458 tab
4⤵
PID:4272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.3.1873322968\2027596009" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3420 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26d9baa6-4f8f-4769-a4db-36321bc1e488} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 3436 1f606269058 tab
4⤵
PID:1304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.4.570697356\1455198726" -childID 3 -isForBrowser -prefsHandle 3420 -prefMapHandle 3456 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4726343d-ca93-46ac-a92e-3e66ea6bd01e} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 3648 1f6157e8458 tab
4⤵
PID:1156

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.5.963943594\1528848301" -childID 4 -isForBrowser -prefsHandle 4452 -prefMapHandle 4480 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8aec3c14-4f03-4df3-b4bf-589a0e185b9f} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 4468 1f616397158 tab
4⤵
PID:5808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.6.877490451\1341674352" -childID 5 -isForBrowser -prefsHandle 4620 -prefMapHandle 4624 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d083c621-2374-419d-9953-4176e67dcf31} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 4504 1f616398358 tab
4⤵
PID:5172

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5616.7.400609363\1552379698" -childID 6 -isForBrowser -prefsHandle 4820 -prefMapHandle 4824 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1256 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0041b25-2fb2-42ce-be86-313737779b73} 5616 "\\.\pipe\gecko-crash-server-pipe.5616" 4816 1f616398958 tab
4⤵
PID:3204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Flash_fund.bat" "
1⤵
PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Flash_fund.bat" "
1⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet.bat" "
1⤵
PID:1880

C:\Windows\system32\ipconfig.exe
ipconfig release
2⤵
- Gathers network information
PID:520

C:\Windows\system32\notepad.exe
notepad
2⤵
PID:3504

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:2768

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5356.0.314835269\588030585" -parentBuildID 20221007134813 -prefsHandle 1588 -prefMapHandle 1580 -prefsLen 20949 -prefMapSize 233105 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d5f55ee-36ea-4e36-8adb-9625f65bb8a8} 5356 "\\.\pipe\gecko-crash-server-pipe.5356" 1664 2123a7fe258 gpu
4⤵
PID:2376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5356.1.2124298694\874351349" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 20994 -prefMapSize 233105 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f984e725-9086-4a97-8390-9d876339d2ff} 5356 "\\.\pipe\gecko-crash-server-pipe.5356" 2004 2122f8ddb58 socket
4⤵
- Checks processor information in registry
PID:3176

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5356.2.633872863\24402924" -childID 1 -isForBrowser -prefsHandle 2744 -prefMapHandle 2740 -prefsLen 21455 -prefMapSize 233105 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ee81349-8dfa-4a39-90a3-23991b39d4c7} 5356 "\\.\pipe\gecko-crash-server-pipe.5356" 2752 2123e22d958 tab
4⤵
PID:2796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PowerShell
2⤵
PID:4484

C:\Windows\system32\notepad.exe
notepad
2⤵
PID:1624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat" "
1⤵
PID:5000

C:\Windows\system32\ipconfig.exe
ipconfig /release
2⤵
- Gathers network information
PID:4788

C:\Windows\system32\choice.exe
choice /c AB /m "Would you like to Access your internet connection back?Y/N"
2⤵
PID:192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat" "
1⤵
PID:5004

C:\Windows\system32\ipconfig.exe
ipconfig /release
2⤵
- Gathers network information
PID:5984

C:\Windows\system32\choice.exe
choice /c AB /m "Would you like to Access your internet connection back?Y/N"
2⤵
PID:3124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\P01S0N-main\Free_internet1.bat" "
1⤵
PID:2780

C:\Windows\system32\ipconfig.exe
ipconfig /release
2⤵
- Gathers network information
PID:5672

C:\Windows\system32\choice.exe
choice /c AB /m "Would you like to Access your internet connection back?Y/N"
2⤵
PID:312

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:2232

C:\Windows\System32\ATBroker.exe
C:\Windows\System32\ATBroker.exe /start osk
1⤵
PID:3912

C:\Windows\System32\osk.exe
"C:\Windows\System32\osk.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x430
1⤵
PID:3092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
PID:6128

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.0.1576298333\450930571" -parentBuildID 20221007134813 -prefsHandle 1580 -prefMapHandle 1572 -prefsLen 20949 -prefMapSize 233105 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a9d1fce-a5c7-4880-a5db-455e97df92a5} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 1664 283ed805358 gpu
3⤵
PID:5060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.1.1084075626\595180151" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 20994 -prefMapSize 233105 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65738d89-62c6-4830-bfd0-bb099799a969} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 2004 283ed638e58 socket
3⤵
- Checks processor information in registry
PID:3396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.2.1111501400\39279096" -childID 1 -isForBrowser -prefsHandle 2724 -prefMapHandle 2720 -prefsLen 21455 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f50ffbd-b48d-4b6a-a421-555a3108188c} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 2736 283f0ef4958 tab
3⤵
PID:4056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.3.633151706\926257516" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3408 -prefsLen 25860 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07210a61-4beb-4e55-a0d4-d53085d8d954} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 3424 283f23cf358 tab
3⤵
PID:5188

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.4.1838545081\1848505870" -childID 3 -isForBrowser -prefsHandle 3704 -prefMapHandle 3700 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e951e7be-edf6-4ab2-9391-512562cbdb05} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 3716 283f26f9258 tab
3⤵
PID:4944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.5.1458149736\2037487769" -childID 4 -isForBrowser -prefsHandle 4572 -prefMapHandle 4568 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d59ebaaf-5d24-4d40-84e4-c9eb3989d6f0} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 4584 283f3745d58 tab
3⤵
PID:1708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.6.636396783\32930698" -childID 5 -isForBrowser -prefsHandle 4724 -prefMapHandle 4728 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4009354c-236b-429a-9c90-65ecaff7c26f} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 4716 283e2b6a558 tab
3⤵
PID:3932

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.7.2039595717\139783142" -childID 6 -isForBrowser -prefsHandle 4928 -prefMapHandle 4932 -prefsLen 26640 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e99253e9-520e-491e-858a-9c9837db4658} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 4920 283f3747e58 tab
3⤵
PID:5868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6128.8.1592678531\506324448" -childID 7 -isForBrowser -prefsHandle 5452 -prefMapHandle 5432 -prefsLen 27340 -prefMapSize 233105 -jsInitHandle 1312 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f78bcb88-6a7f-4250-9269-b1662a034b90} 6128 "\\.\pipe\gecko-crash-server-pipe.6128" 5420 283f5e2ab58 tab
3⤵
PID:1360

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
- Modifies registry class
PID:3112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\test.bat" "
1⤵
PID:968

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4244

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3532

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3452

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:320

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:5840

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:3940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:1932

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7372

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7380

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:10124

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:12868

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:14364

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:14424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:17064

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12604

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14100

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:15072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:16636

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:21340

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:3628

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:5488

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8168

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11592

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12908

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15116

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:4556

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7196

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10752

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:12664

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:15240

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:2872

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:10028

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:3032

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9540

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3692

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1748

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:2252

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7268

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7648

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:10804

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:13364

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:15236

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:5072

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:13544

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14852

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:17204

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1132

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2912

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:624

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9156

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10412

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:12892

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16224

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:17236

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:8492

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8640

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8152

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:4900

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8488

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8136

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18444

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18452

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18460

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18476

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18484

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18492

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18516

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18524

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18532

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18548

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18556

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18564

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18580

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18588

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18596

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18612

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18620

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18628

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18644

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18652

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18660

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18676

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18692

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18708

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18756

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18772

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18796

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:18836

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21620

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21628

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21644

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21652

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21660

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21676

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21684

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21692

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21708

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21716

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21724

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21740

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21748

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21756

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21772

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21780

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21788

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21804

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21812

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21820

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21836

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21844

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21852

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21868

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21876

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21884

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21900

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21908

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21916

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21932

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21940

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21948

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21964

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21972

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21980

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:21996

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22004

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22012

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22028

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22036

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22044

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22060

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22068

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22076

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22092

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22100

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22108

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22124

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22132

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22140

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22156

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22164

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22172

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22188

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22196

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22204

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22220

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22228

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22236

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22252

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22260

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22268

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22284

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22292

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22300

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22316

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22324

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22332

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22348

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22356

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22364

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22380

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22388

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22396

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22412

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22420

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22428

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22444

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22452

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22460

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22476

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22484

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22492

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:22508

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22516

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22524

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:10428

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10512

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10532

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:10580

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10584

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10668

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:10700

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10820

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10908

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:10928

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10984

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10992

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:11160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:11204

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:11212

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10304

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:11324

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:11308

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:11316

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:11352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:23956

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:23964

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:23972

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:23980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:23988

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:23996

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24004

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24020

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24028

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24036

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24052

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24060

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24068

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24084

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24092

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24100

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24116

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24124

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24132

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24148

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24156

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24164

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24180

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24188

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24196

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24212

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24220

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24228

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24244

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24252

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24260

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24276

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24284

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24292

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24308

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24316

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24324

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24340

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24348

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24356

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24372

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24380

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24388

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24404

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24412

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24420

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24436

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24444

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24452

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24468

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24476

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24484

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24500

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24508

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24516

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24532

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24540

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24548

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24564

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24572

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:22768

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24588

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24596

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24604

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24620

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24628

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24636

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24652

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24660

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24668

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24684

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24692

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24700

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24716

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24724

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24732

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24748

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24756

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24764

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
5⤵
PID:24780

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24796

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24804

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:24816

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18908

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18936

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:9084

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:9088

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:9092

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:9152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:9104

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:9108

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:9120

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:9128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:9136

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8080

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:5700

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:19476

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19484

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19492

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:19516

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19524

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19532

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:19568

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19576

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19588

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:19612

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19624

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19636

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:19660

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19684

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19692

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:19716

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19736

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15160

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17124

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7348

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5912

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5440

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:5028

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8848

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10284

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:12752

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:15540

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:17196

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:8200

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:13672

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16948

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7328

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:872

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5608

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:5052

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7716

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7728

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:7744

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11564

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12876

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15092

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:14712

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21332

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:4340

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:23484

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7752

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7760

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:7784

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11476

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12816

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15024

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:5756

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:21592

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:5064

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7796

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7804

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:7836

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11688

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:13040

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:14872

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6456

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7844

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7880

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:7916

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11884

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:13216

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15528

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:6512

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6508

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7936

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7944

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8052

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11572

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12884

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:14832

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:7576

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:5236

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8552

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10452

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:12936

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14856

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17132

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:5828

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4876

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2956

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:5916

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7476

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7484

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8632

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12168

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12428

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15632

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:18980

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:1276

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:23500

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10864

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:12704

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:15268

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:5588

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:23492

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:636

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11792

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3792

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1764

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:1304

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7688

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7704

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:10216

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:12656

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14216

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:16908

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5000

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2140

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3108

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9472

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10432

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:12928

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:10948

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:17812

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:3296

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14900

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17164

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7312

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1288

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:6064

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:5860

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8252

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8264

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8280

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11892

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:13224

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15432

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:8196

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:4152

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12284

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8288

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8296

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8312

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11868

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:13200

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15440

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:3140

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:10020

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6320

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8320

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8328

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8344

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12036

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11864

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15640

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:20628

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6488

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8356

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8364

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8380

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12148

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12680

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15616

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:19004

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6520

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8388

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8396

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8420

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:11876

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:13208

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15448

C:\Windows\system32\cmd.exe
cmd.exe
5⤵
PID:7632

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6572

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8432

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8444

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:8464

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12160

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:12276

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:14704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:15624

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6640

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8476

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10320

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:12776

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:12624

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16972

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:14872

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7220

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3204

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1896

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3812

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9824

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10780

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13632

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16812

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18376

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:792

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16104

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17024

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:8012

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5136

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2820

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:1780

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9996

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11024

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13904

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:17080

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7296

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14780

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17228

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7456

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4272

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4420

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:4976

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9496

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10524

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13096

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:15136

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16504

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
4⤵
PID:20884

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15288

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16956

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:2336

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5492

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4256

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:6016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:5928

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9800

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10712

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13336

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16716

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18136

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19788

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15708

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17148

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7292

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3764

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5068

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:6100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:5080

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9484

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10504

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13016

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:15820

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16980

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7204

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15004

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17116

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7448

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2908

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5640

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:5116

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10004

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11008

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13896

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:17092

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6376

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16344

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17244

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:6440

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5408

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4056

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:1440

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9756

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10692

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13392

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16668

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18152

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:20204

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15780

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17220

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7440

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:6104

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4692

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:6132

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9792

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10788

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13576

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16708

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18228

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6220

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16052

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17072

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7240

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5208

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3728

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3340

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9744

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10684

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13424

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16652

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18176

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19796

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15792

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16964

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:5624

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1020

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3044

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3564

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9096

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10440

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13008

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:10968

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:17032

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7192

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:14828

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:15072

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17100

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7176

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:1784

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:6060

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:4440

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9968

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11016

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13932

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16400

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17804

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:18996

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5868

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4860

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3768

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9776

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10704

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13328

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16696

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18196

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:19380

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15692

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17172

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7280

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5400

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3460

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:2644

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9808

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10720

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13440

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16660

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:6864

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15824

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17212

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7548

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:936

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2232

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3892

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9836

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10772

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13520

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16724

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18144

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:20196

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15944

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17180

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:4268

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3456

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4348

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:3560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:3648

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9816

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10732

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13448

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16644

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:18168

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:2068

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15832

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17252

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7560

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4852

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5004

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:5964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:4824

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:9480

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:10516

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:11456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
3⤵
PID:13032

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:16412

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:17040

C:\Windows\system32\cmd.exe
cmd.exe
4⤵
PID:7832

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:15032

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17108

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7528

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:8972

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:10360

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:11336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K test.bat
2⤵
PID:12844

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:16000

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:17188

C:\Windows\system32\cmd.exe
cmd.exe
3⤵
PID:7352

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:11840

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:17140

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:2460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Defacement

T1491

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Filesize
1024KB

MD5
d9a49a7d6d5ca840cf0f0e937007e278

SHA1
90197e483cc1bf8970cb6012997b1968f43d8e78

SHA256
183acf4a52e283da352ac2e3d51d43dbdd1534325f4585b6763a4ef38151b876

SHA512
142acbf150500db5f703b3e56c42895cb4374927f6e26adb02f090cf18e9797b8f4e34b7e621de6daf03093cc0a7df73cb4328525ac7a1a4f36e2b61dfde0642

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\35a14d9d-d288-4ac5-904d-e8feef90fe31.dmp
Filesize
1.2MB

MD5
64e7836308dc1744ddbe5bf561f29e35

SHA1
40e0e43df999cadd5ec17e201baab080224bd084

SHA256
eeb0481f15fd3dc521029cfef1a1a96bc4f56ab2e5bd3214963819d1f1cbe90e

SHA512
b3c3611773999556b888a8a4b70171e3a7e5a067049042d16015216d0abed88c7978c794bd8f94c98c2aa0836c548733310a560966786c0ce3726e89d552d8ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
bde7940abd784d91f9236ffeea928533

SHA1
1d994b328619ac40307ec13707ed98f692e43e01

SHA256
e54c95fa9510bd1c09c70fbdd534fa96b9add223be9158e32c12173572b3ecf5

SHA512
61cdbdfe8a9df3aec8a4281912075cef72072c9d6f96ab74e201fe532af138883b50223fee268a8e0121afebcfce1c8036307cfb66afcf2582dc76eca27b4f30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Filesize
37KB

MD5
f9d7c9aef654e1e17a11be30db91ca01

SHA1
33b723c11219afca1a29848fd8d704f30f7393c0

SHA256
33c33ea60091eb455c214a4db497629538bd6fa9501948469982513da0277e87

SHA512
fde2b9fa466bb082b0359902282f90688c61bbd0f364c1e60bcb923b7c7397e7b3f6c64fdef14fa1a54787c12dda9724688e86526e579954c30efef782a6e8aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Filesize
37KB

MD5
669b1563b95fce26d9ddc3c7e9bdc538

SHA1
275e4ae2606a0da908003b77ea06b24ea8b66214

SHA256
d46765072d87d9892a0f6f8f9849eafe0abecee9d662e99f8b45d8c5b22ac667

SHA512
09e066f5a1974927b2cb607a8b953f2732928c7347f65cdfcdb573170840562de6eae091a61108827b3ae0799c16bfbd41d858ee1a8bc57d9bb1fac814438302

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Filesize
20KB

MD5
628ba8d31375849e0943894669cd033c

SHA1
4fa6d50a37fa2dadec892474d3e713ef9de2d8a1

SHA256
80e3440c312f921afe33a7d4a3d11d1d2dc7162f8f50b748b796f424441d10d6

SHA512
d4406493dc8767c479460f3039b038866549feebf392280384da08adbcad2e871720d046220cb67ebe3ab75c14e06a31df2fa7c0f2c17f91eda26ba0a709d27f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Filesize
22KB

MD5
bd020e9040ce5d0e8fde2c6fe3ff32b9

SHA1
1fc3668cfb1103b9dae1c8f6b74ae0b14186da39

SHA256
4d79de6a8a36100cc1181fc7d01b0aba71be35ec6f5119e30effabfc4945c945

SHA512
70c9ca94e8ea5d257cf2c7b211b5fde7eec6b0cd51e688c3e4553b5ed02e90a6911d0df5cf37f105b9df708da7f5aa3b0129990587957d98d9b8da0b0e27dd45

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Filesize
20KB

MD5
0f3de113dc536643a187f641efae47f4

SHA1
729e48891d13fb7581697f5fee8175f60519615e

SHA256
9bef33945e76bc0012cdbd9941eab34f9472aca8e0ddbbaea52658423dc579f8

SHA512
8332bf7bd97ec1ebfc8e7fcf75132ca3f6dfd820863f2559ab22ac867aa882921f2b208ab76a6deb2e6fa2907bb0244851023af6c9960a77d3ad4101b314797f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Filesize
56KB

MD5
7011d04c03675c1a8781e462d44fa631

SHA1
c5ed8051f347633da24268b2d8d234de8b81540f

SHA256
7f4e6f1c365783b8d95f86371e4ca0a1c76fd35140f4bc7c128a83477c1aa121

SHA512
10ff7595bfa0a51741ba6f51e4f5f03dd3d50361afb0b257bafd548b879952c8204cd549657372af74623775d987fa3584d45fc3da0087e35915667a250d49d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Filesize
59KB

MD5
4bc7fdb1eed64d29f27a427feea007b5

SHA1
62b5f0e1731484517796e3d512c5529d0af2666b

SHA256
05282cd78e71a5d9d14cc9676e20900a1d802016b721a48febec7b64e63775f6

SHA512
9900aecac98f2ca3d642a153dd5a53131b23ceec71dd9d3c59e83db24796a0db854f49629449a5c9fe4b7ca3afcdd294086f6b1ba724955551b622bc50e3ba1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Filesize
130KB

MD5
9446510042bf99532b01766c30fc2c89

SHA1
670bf1cb1199501ac3c2af52ca072c6e18ab59c1

SHA256
aad677ed5c4458689811b5e0c3532827a9fcf6602e99baa7fd62b1a7fa900732

SHA512
84c45125cb56f56ef84808fa9db47f7ae7618cc4a75824c22ff075bbdabc6f10bc195703e4c0a1c7eadaa9db492ad2c280e724ed4e3f50c8357f69c16df39266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Filesize
21KB

MD5
0e52c094a93d5bcd8875cce575d7da9a

SHA1
de9ecbf399f77a497c96c1a4b3509153ad9751a2

SHA256
abafb66ae53e45e075a02ab40e19bc2dbb0126d83f4da5f1fbd3bed1a4b4fdce

SHA512
b2cbb5075eb1cf84b9b24c2a2f3165675496d506d5e98a8868c18514c5740c366b5a29a925dcf6f6cacdb8ce6e39eb8673b15ebb55c5e9078e0d7eff631905cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Filesize
19KB

MD5
7525eb7aa22001b97867802c8f4f7bf5

SHA1
310052312d37e6691455805436126167de70fd7d

SHA256
d04a76912e0c936eff8579f4957d4b6322feb0be044b40bb9596a8cbeb2916b9

SHA512
8f387009dbd1840469859ba9d5f36f038d8280d8d3838f2fd8d4e244b1b489aa348d0cea956ab1d3f235f88f434a32d11fb7360ac0acf2ac4b317088a85d31f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Filesize
67KB

MD5
0790b02620095d8603073a3ad5597885

SHA1
6d18ea2b7004b66dd8820cb2583dfdb025662c7b

SHA256
75f4fcf7226600765c7389e4c022bdba4eef8f108d114dde706ed16c867aeedc

SHA512
4bb54a127c1356828a3f5d76bba34a1f7d062e76d1376521ffa85b312769e334bfbac415693e33bbfcd2cff5c4c5b414741bcddd465a4e812934e192791f4c66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0fd5b0b126a0e456_0
Filesize
3KB

MD5
e1de80c0a246c18137e3c6cef9de13c1

SHA1
38f13ea62b293287aac8b7cb2e892d7d19cc4753

SHA256
31e09921d6f06472ba8f61c6a2e4e2727b46d96938c960879d01cf6d12ed5293

SHA512
39146a9e0a891fd9dffb3b9fe80ee930f13dfe946336700c222ddc59da77a0bef6c0583c50edc375fd19a43da14595dd6f251d367e2d6963ce8bb555542176ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\118a680837e379ce_0
Filesize
11KB

MD5
5582fb40cecf4eb87ddba5a596d95f65

SHA1
d2de53c200a26a2cb9a25deb8a12558be5f3e0f0

SHA256
9f7d5d8cee184c4df58ef6c5c8d5ab3f844d71cd0f5f7e7644dafa521752d35f

SHA512
0e0bcc18f98191c88137dfc9250ee5ce29f247557a3ae97ada69440f45d5ce4cc91ab20814dc052fcb42f3f91ccda9e0ba0211ad918e6296a72f11ed47595aca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\1b4a14d8ed229b8b_0
Filesize
1KB

MD5
b4515f869e947a0e63a587bf6ff5f215

SHA1
8e5fdabaef29394536bae74d98533ca6dde7a8b0

SHA256
c06675d2ac365fa3bfb267752fd23ac376667802767cbf7b17639496c209b9bc

SHA512
844806cd7c6ee58f65899df8a8b1e167f342f7f9ba700330f2b2287da699e26bf3b3c456cf1d2fb5031933da351ce632d256394730aaa6770d909157314f01b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2b76d7967c518e37_0
Filesize
1KB

MD5
69e6070c2f592e36314c618ed6c31b4c

SHA1
a15400272978edaaa6c224c2db67f0dfe27c1ad9

SHA256
ccd74587e56eff0bcf9f9449bb960800ba3c818e8adb632b0cd0218f232e1207

SHA512
9d513bcf9276246ea3972c4e8b973d7c2285840b3469ca2c8ea9f6f4a0e9bdc8c8e40053d37ed31aa059de2a74cc4171a493f1be47f424a832981b3f50425b74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\372463e8c7120bef_0
Filesize
2KB

MD5
324e9a287611d1e5d1f1ec002ec6a1da

SHA1
7a210848fa86a1dc397babf8d3a4c1e43ed71bd0

SHA256
5822e6d11e2c2d6c369a269a4399e5bd2b227bf1c71f325ddf8b01d1d19f02a2

SHA512
84593abf1c13850c7690c9f17e0eed006d74a4219853f957e11f91166ed14ae8990af8e1ee54ca769014362b6534bf2e27bffc2f1eec72f1c37545d127ef6e7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3f305119e054ab54_0
Filesize
1KB

MD5
a0c60d95489f38348d95b0da01deea34

SHA1
de4d189019be09fd81291220ead92c3dabcd6ca2

SHA256
cfb81b09af1d57306a1b8eb478a85dd3dc2cc7f0cf08b6f8540e95dbe2c093f9

SHA512
0fd2774ac2eb4a65d393eb42eac9ff8453cd95ab54219d8627a5cdfdca68e8877afbb7d15890c8d3b5b2e4453be3753bcffd31b0318f24138db7a3e82c26ed6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4f28add35fe51c4c_0
Filesize
1KB

MD5
b8f89c332fd0f2d4a48797745c33aa0f

SHA1
1a6f32f99d60782a60ee02b9a043eba31d737a3f

SHA256
c2fdcd41753e5623d5ebc48e2ecf052e9cf3d49c5d741a262f26e5624b5cf5de

SHA512
e92f507da03145d3909f2c51bd5b9e12ae084e0162f417bfb76726d2f1dbcf0c8dfbf89be5dcd1d1131a0f2f7a9735bda9016ee23edd50bfb7962d4a2b3b863b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4fb2318a249e0b2c_0
Filesize
3KB

MD5
1cde54b87dfca45c95e67cef60c81f67

SHA1
825cdb4f533d3bea9a488b0a44ca46066684fc9d

SHA256
48e8fcdf9fafad9f34526d195164ae2f699caa06534644ab246a241a26559710

SHA512
8f36048fa589c6ebba6ff68cc8f0f057e80b0c599b9ffb76681de6031bfa2dac95596d09ab2672af85e837f286e3bc9742a14867d8cb91067ca471929c445578

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\59b92086e751b46c_0
Filesize
19KB

MD5
921a4fbed37aced29ccbe08598dbf5cd

SHA1
7e354b57a62eb5c288da8e7fd9d86b89ccd9642a

SHA256
ebd7175bf6396009df497b147bca34d29c31a3b19b71f14830535d6937911f7e

SHA512
febb79a9a343f10e9a512d89e669be582cb0fc5f451ca0415b177e20cc74b7ea920bb8bf2d940079ddc75103d83e587cc91028af2c5a20cf075cf5e9df762c68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5d571593d7f93f31_0
Filesize
5KB

MD5
1853bc3475993840ceb9de70022a5fca

SHA1
dcfd35855296d92135781d60aa7c3cd105f53e8e

SHA256
035b16fd178e826037389bbf4abf9659986d05d49a26d2a47cbd49d6e13845e3

SHA512
87506ae6c380979de4370f1279540d5db7ecaa5da1c6b21d7a95f18b2975af991cb53f098ae84dc31381a72087c64dbc39310225be6db0d3383739376fe08706

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\5f8ad7366468e018_0
Filesize
2KB

MD5
97779e1edac607a554f53135d7ee16f6

SHA1
e5ffc78699571bdeeeb344d3a269304a6c30b585

SHA256
b0d445fdb9bf088f75300036d36a096e1571d72ab8705afaedc0c83f356599e9

SHA512
1aecae2bdca56dab40632e1e7a08727854d02d8513d72abac6eefed068d66b29ea7b86c26170ac96a3a6a3990ce5b67ccc99da349ca1b91e1f651ffec45d9167

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7a5cd0af6b633a71_0
Filesize
1KB

MD5
ae65b3605516258dd7b53c1f64fa0f69

SHA1
0342e2c22c79a213552c7a7e8c7b521b037ae69a

SHA256
80da8e6f15443f18c5150e855d7a36ed2394b00270b83d6633094dbd5868ce6a

SHA512
babb05bbd9d633cf42518c2ed0085d0e0a1326dd1c6a37defb101a7e18306bdf43594a61d866cd37a0f364021e6b4d80937eee970d836fb044bdc42dc6fecb86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9d4bf558058ee46c_0
Filesize
3KB

MD5
a67d84abd3930a5f30028cce94994434

SHA1
1b2eb828888a8b750037109489a50d83621e456b

SHA256
3d6e67d279ce17a47a3faeef0efe0031c725577add1c8e49ddf7c5ad231db130

SHA512
d0be4534ee5cb390fbf8bd003027be996f6cdd10018dfc5cd4d8a33a54910aa9f538b2df721dbd39041600e8f484c745c8b3eaef3466b52f496576ed0aa159f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a067c42b64722a57_0
Filesize
1KB

MD5
b12f898014bafe17c38cf6c2238ae568

SHA1
94b987dddda4375d8703dbb42cda9b9bbf52becd

SHA256
a0c8f9ed8364c135bcf99ba6aab4b20ffdf5efaa51ecde2a5d1f2fdbdc79f9da

SHA512
2d4cc463524984c87ceb18df46e2689dff6d70f97137bb87862d0bf747d02176e463b838c0eaa5c9ec5f0f9a04b3fe428b34ddb8023adf8c8f25f36e0ea5d7d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\aaa8107def98c430_0
Filesize
983B

MD5
40adaffda0123ebebe89c44d0961ff44

SHA1
d2576def13f279fc80d527ae06e6d65984bbdbca

SHA256
1bfa0f7162c8dcd4904cac8fc42ea71b09e37d580adae59f9561b249de1825c0

SHA512
c2dc7669ca7620a080fe0d85d5298c22ff01eb5750fb7d5c71661c105ebf089a4a2d22b503dedf6168d57d53f8ae7c945be70d30ea45a2d6b1209851c8b04110

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bd9104cced1b007a_0
Filesize
1KB

MD5
7ccaece38453fd767cfe789cde3e153e

SHA1
cc7787ea6b34105c50aa0bfe9566226fd03b6a62

SHA256
8ece35daee51c8ce6e9a188fbffcc6005bf645e56771eeaf62654f0e61447fc1

SHA512
1a96cf8b4bbb4a6d721aff1249bfb2b93ffac08fa078fc3936f7fc979734b2dccf6419c64fa791e89a28317f067c0e426f129bbc4e50bca10bab1de23e7348a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\be68bc274cf0fd90_0
Filesize
1KB

MD5
0f02ebcc4b52844ab5e124a7aec5efe2

SHA1
cbaa15e01d437e2a87a78b7bf056910c8ddb74f4

SHA256
66ccba12ab24f1ead9e3bc45eec499d247f77de7a0b8bc0852303861b4e9e525

SHA512
ca6505aca2e120d6cbdf04441e0820530434aaaf0b429de39a251737a183629fb3f11adb1929da7759860da09b4f09b58fad6a75df0bbe650b8c71a40625ff5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c4a81d8e00a5c0a9_0
Filesize
5KB

MD5
38095c6b9ed043cb3665417043dec25a

SHA1
5a495c283e551214bf79cc117f722185bd30ee13

SHA256
afd62d0f1b8c03df1782617873efba723e340edc531b95aa047dbb62e87cf018

SHA512
6be4e29e522002eb098b5a357aca4ae9d5d0cdf21d8bebd4ecd92d818f6199c9535a6aab7cba8b601186dfeecacab29b9f486322dbff6281ad7dd4ca6c84611d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c637970bda5d03af_0
Filesize
1KB

MD5
10f5f5442b1a323a37b024689a8ec071

SHA1
5c87c5e8a004372f94a35c31dda96c670d3afbf3

SHA256
c689611564ecd182b758ecf5faed7e615177c95ddbef59f4d0fb97a075d257e7

SHA512
934c0bfec9cdbcb40895838dd8a9d64b96aa0a7b00fe6b0f5889d7f665a932c6a0b2df3462d9211e50bf1e489ec841f536d5dc534c4f1f74c67975d9ba0f7e37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\cb42caf0956fd2ab_0
Filesize
1KB

MD5
63997083f4a85f00ef093932b5614825

SHA1
4103643ecc9d54d1d166ee3db5316ee7db3701b0

SHA256
53faaa834ad98760a86e88d04d8198c67e7fe954dec596ab2717a2e2329f0d1c

SHA512
44b51a7273d3e33be91d9be028452b1572d1401ff525366bd3afe775a7ef1d2beab36acb0e183b39532a76785d682ea5b3bb941728f3ed2364831429a5f25de1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\ec0f84f95215d943_0
Filesize
332B

MD5
74e5d89fe8908b4a520e55700c31609d

SHA1
17c22d9b74d91c9848eb6600dbd893d05dd6c532

SHA256
9855a4c146727a1464bef5629a305b3450e9b66deb5a929693e27c7e474d16f3

SHA512
ec11d676b751527d84ddc94fa930679bc9b725289a67e6950d395810201eabf48aab1d5c6a914a4722c395fd7bbb7c270961f9c42b2ea05ce920420900453da3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f63b2dcf918f4446_0
Filesize
1014B

MD5
c05a411753270218d173a3fa0e394f76

SHA1
80f41d72d24e1ad2861d07e5b31a3946fdaeef28

SHA256
9e04a7a88fa988bc17a7f41949879c0fd047f600f91d10bc28a401bb8dbe67ec

SHA512
389fe4341a3766fdb1017cd98070ae73b4515e8b031e145c45542cd0a39d37ee98b238a17ec4835b23557cc9911a3a6a8aa29f39a51491258e011ef619fae40f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Filesize
672B

MD5
a03facb20875afe0fa22092ea700d573

SHA1
4619fcfe37e5ef56bbfd5ae5f0c7ff5eb0d4baa4

SHA256
59c4d0830a53bc9f09d32f94033b10fb62335ccfb454a4703f445fd2d51ef710

SHA512
144fece44fe57804760502973d37ee617090f9166ee0b960542e84edb6d04cffb5273081c7d9688dbc0c0f3d7a96c9b11b92098b253ea04d4ce6192ecd99baea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
48b643b1e949ac275eef5173e64adb34

SHA1
c992e884c246075a7de7b54941731c89db966fa4

SHA256
ade014cb9ee3b4462251d67f433004fe3ff0b08b2f34ab3ae9033b8abb16822c

SHA512
7b424247688319f6517ad0b9780a3bfa2535a193d75e95007891dcbbc8274faf47198da54c7c3cfb275a7e75bc8a8a96281a498f2e199c777dd5c5989b590d5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
499d73878b5b5a86b6bb8c3b2973c8e2

SHA1
c6061ad55b4888169bdb337a602897547ea5bf8f

SHA256
7bb8947f2283fda05110446ab5cd7ddacd4fc5896203266fbc1b911225cc1fd2

SHA512
09d113c7a875242bc5c7ebf6c99f83b2d3bb0b9c2e29f833e5a7474e6bc0aad29e660a6f3f91eac8594a19d7c8548b1676314e10c65badcee65a6baa5ea1692f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
dd3cc245ef92ae0b4f09d92482205861

SHA1
8039827cfe50c7fe51c6801a6667dec5334356b9

SHA256
84f559d5f8b24d22e12ee7c6d2d050d3ba96ec9df787ca5c696f3e0291a0260a

SHA512
967f2232f80c119ecf3e565aadba5428035052c7b1a917f374ee6f6db3f068597773f9b8b5564cc8480aff2e2c0a30996ceef3e70a596846dc91c676c81e496d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
4fd4d817504b1af884c66b58182fa078

SHA1
2c2c0aaab0364624e5e6b3242a05d3c640b7f6d8

SHA256
5c617f450385a9ff5c8d4366f3782f4f0e4f0b185b9cb92203fa146883fe4cf7

SHA512
c1f028148a97afc43c49aa26383f55e495cb78ceef1cccbb8d867218eb5356eb23d2df08374c014ecd60bffac9f6d55cfdfa529649b0c437ca5506d66b0952e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Filesize
148KB

MD5
ce47802e475f455e78b417be2a85514c

SHA1
8df592ff94947883256ce82746c0096ada18f247

SHA256
98206cd45fd825972c58962e4fc849383c01146054aad82a7658e0f07a185d18

SHA512
1d9e79cd79c5252aad6499d923eeecd82ea240739a1520f9009f65f5ace423e7e3220f2b6bde6e5b5c8d4f863ef5899c304766471559c56b664f217cd3c48bd2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
9fee452db1054b677ccd19615363eb0e

SHA1
667020c826e3f0bfb3d2791147bf689aa76ff429

SHA256
4ffb0b3bacf8d70c857f6b5136fe9539ae52a7df48d91144139e32fbfdba54dc

SHA512
bc757fed7bf2114a82cd0e7e7545afa579ed9559789074e2656fa0fcd3dfc4587a9ea1661ff75f4c35c898f68c1edf5140d91d23c9cfde151a9fb2d1f2c7548b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
0a84ca256e8338b6e7a5390d23ef9bbc

SHA1
bd3ac74eba79149736c8403b94e5ffc33e2c8acf

SHA256
71d4151e2a88879740ec9b7249ee460ef0e3c4b71ac56acae1bba7012358c70d

SHA512
feabf5e9692f191f30fd2e4c7c71bbd9bb58b271d253fed72b7d88f1394b4142b69aad63c403f1d1c573c4d3bae06f2872d51996d3e43fa10c6dfaddd30a143c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
2151ca61031fda441bd9ce3593a8e599

SHA1
cfb1afebee4315deffb5095d4e1a5a62db624ebd

SHA256
b8f7a4d9300c52fdd4e11d956d8f2b16f1ef86f709c04bb94004411fe52ee446

SHA512
385710b77e1ce38252618c21f3cc051d06963cf71bf760a8342956c2b1392b293b3b4f4b4146fd4db22203500d2fe7dc061a3e2d86bd76da162a2b082d059875

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
83ea089fe1c6d578db647a0684c89646

SHA1
140b073c7976463f7384ced75e29b9d8b182d706

SHA256
d10866d0d05aae798b0a5a82f90921e8168c8f0bbf6147751fb779fc1ef1a33e

SHA512
22c7bd6b4474b0ad57c51ce76b768e2f1df0c1627d1e7286b879f90e9729775fa46d39848898488a63841625b850ad464ae31b7100c28fcc26b34702dce09d39

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
7568768f3342e252018cff3026d2c954

SHA1
0ffb22127ad36d1e721e5277a3fcf609f5c4ce86

SHA256
4c1c875773df215f35dc22fb30d8edf33604665d72a2fc01b92c0a2f686d91a7

SHA512
e461b3ad2f866662e3bcf89a808a7aafa94db007308d05789b03ab18eef5d3b31bfb43d5370e4749c002d74df22d86ee5835787903058df41c5a82d04fefa989

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
16be93a8f64b6fa4d4878fb9cbcac9c1

SHA1
3482e56d2140e040b6dd591c760161c2ada4c3ad

SHA256
137919a03d311f2de6d24e4bead642aa415ecef147f676f044bffb467d4450db

SHA512
fa47ab69c9174091ba6a51cdb473725211600547599486e9a464248db59101c9e292f384c5a7e7eee51de3c10695e6122d73dbe670c409901a127dc36d260940

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
6e49446a22dd2beb96f0640d0bbcf7bc

SHA1
d8be061b662cd83a9e1b3c4a1b5e1f03032122ac

SHA256
50c4315a735d651061ac5da0cb70b3542717b32ce667231b0b96d334817fa0a8

SHA512
96936ff93400092fbbdc6b706fe5dedbe7cb35ccbb2578d0414e03ec14d617d786c1b736aa26d2d5b8b863cfc27ceb2d9344db32499c7b6cc5939c591b890e43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
204B

MD5
abc58cd10a08575647206f975fe0aaff

SHA1
939a8c157456d31b9db124eab167ebe34da7c2b2

SHA256
0460e61d253a4c035f7420d8ec96dbf8e8e797f77d16ad0450cf250d53962661

SHA512
e4b2cee541cbabae281c134b5cf4485b8aae0c014b1b7ea70228b020811b56016b9b6a3dfedf71cfee58c03bae148b0041f7482131db386169e786c0b4fe7dd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
204B

MD5
fca199dcc9697d3281c78b84bfa0b430

SHA1
f98ae5413111ab98d69a4eb7c8cdfea01aa66916

SHA256
a65be16cd4636846ede23adf2a6654d0b130a4acbf40da079fcd4ec82f01af8b

SHA512
7f60216a77c59cf147f30994b90fd3d69ed625cb19ca117d166caa80d0429d69bb8eb8222b2a1014d2979ac15e4f8f0b5e3681dc290e5b88e389130aa48db6d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
79bfe50270eb76a43d07a8bb91d3bf3d

SHA1
579af7b2347cf8522223e3b5dfa4f721362fbcb1

SHA256
a44a61ac553529f613e57c2b75b504502ed518d23aa28e403a54aee31491a5f4

SHA512
0dec6bf3222205f8bc4d4794520f40b426f7f0c5433a10617a9bd478b42fe3e5dcc90fcb3082377967dc95f85e8b6fa437b55f45c385e1eac2bc5916df42d58d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
0836dbddefccc6c2d1fe35a556045154

SHA1
040396bdb4cdbd77842817efb7b1bc932e031800

SHA256
681efb1fa2ef9ee688e22bb421ffd229140e98603b686132dc843d57ef3213b8

SHA512
debd0ddb75057c1f42b8c860c20045a5d51a0fc40c8f150e9ad8ee6a7f36a819169eee41f82f6e763b521110fe85642570c7eb05bed359e21cb92459a24f812f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
372B

MD5
e54ad2a131714efb4186e2d47d79867a

SHA1
f6178f9e8f533611acb85fc3db0ea99ad8c70d03

SHA256
ca2e259af9c2afcddedd4f598e76335235572f79483c015532e0330bfc4815af

SHA512
d11a4566fac317e7d104b430c26dab09e416198d545e646ca6d91c2db77d0eb026434073fd0fdfd1e4fb38ceb9451e4cb3cc430c7640d02ed9f70d9f80fe98a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
372B

MD5
23ade606f5574fcd2187a6da213b78e3

SHA1
b00bf9186bea7f960020df4248df68f4aecfc902

SHA256
24b313454724ab144b9bea6a5bb0c8d99ee3f784c0bbfb6f1481b17cba679d22

SHA512
a5b078ab249e512a114dd4038a99401cafd88351a570710a21d20a0ebabfbe11df4ee9aca6e7ef1b1bec249195c5ed5cda2d0ca3b5f16fc8a12519af9d883634

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
e9947078640e10cc9282de1ccd48d0e4

SHA1
d659972dd0d6ceba43241d70ce99a0555bcc0d08

SHA256
ff4865d94a41bc130244da8cd131f33a75428d36a03ac82bff1cd7a3f07b1132

SHA512
cae4869fa43794fa70381bffd2eb84fee1c229e2c8bc7240834066c48372fb674073c3dca036a7c11796a74d8716f1baea7b43b88964b36df9c927c6cb96da49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
204B

MD5
49923a2770b588bb06545a0245aa642d

SHA1
919d424b8712e50f850ab10c8d0b815f204f08b2

SHA256
faf2130dd9b993290a82018f448e3183903f79e4a61fb891fe3c5fa4848e318b

SHA512
76f9d93ecdfbaf81a47fe30c125e0f35f9f5b13f651dd6335e279ee70b9465bef0ebcbdcb5efa85a050c9dbc64044f9a7fa4910a265dc52e18046414d325927c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
bd5d7e29afb948f1790c9b3823b6ea2f

SHA1
d7be135ec4d8575d34e84f38cf052916d079a65e

SHA256
af076948f1bb5f3d49bd418f287f24f5010ca042cc36083823e2e347077aa414

SHA512
4c8f26bf148bebdab4b3bc78cb1273336a7cdf25d0b0278cdf010c69caae3d47d2897e82cc9ba26b577d38beb3b76b8abb28695e4c910ad666b30d093a5f3cc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
8ae570d8ef30beffb6b039d3e95667bd

SHA1
2340900d1321305f85e05e4a56c9d6e50b322bb5

SHA256
ce35765444d75ba136b5ce9920beadbd4d3ee712ffd5bb316f0b7cfd1d85cf9b

SHA512
181293aea206a4a52c7ffa292d526c55b5b8bde61cbea2d387ccc1af3c250db21fdc7b5f8e5384a0b7157d37c4617cd88df05e756c5b4bc1464b192a5eef02a7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
a6ccbb7be8b1cf58c42db1ff6d843548

SHA1
b28ef4b06e3c450484c00504b2d004259600a4d6

SHA256
88362159214f668711442c0acfa6bea58084784135ab99d4e63dc49461c3a3e3

SHA512
dda8603a2df4928b77f93fb5f035673515c1f61ccf8d6fd6db69d5b56c4a4ce4876ff86ad71c4408b255517e63a59bd87c891e647b5279012cf43f38915f3ada

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
f28495daaf832f6e77a3658a747327c9

SHA1
52b1d2cd11d7cdd2781b3767e52177b11e52653c

SHA256
150715ecac2ca01c662f7d8f3554aad7db1a5015f58949dd0ff4992a9cb4a9b3

SHA512
7c9ca679f8f75145af60c89db441918e4d426af82a0c401c747b3ad70d0e5b8dc11cf9a5c5ed223836eb083ef14e5fb085ec1edfd5fa4672a3aa7b28fe5f6a0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
2c8dd3209dd838f44644a2139da68242

SHA1
0f9ebeeedac484182de2a8c841a4de37a48d54c2

SHA256
115c1ae9394b46dbb8c1714447f71cf6bb5ae1df74319e0e34638d3ac512d631

SHA512
ca5e7f677bbf57ff154f9097a18f5ecf94a228bce1c9176dc48cb0277adfa76a42235ae47f39920888b30e1434528a39c787e9697448ec5e400cfd32b9008d82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
af7e09749274d1db86077736ea95c521

SHA1
c2a51b63d09e9e2eb58407c41d66e203dac7f223

SHA256
d704ae635a2845952dbdda678b595bb288e333004816fea82a4b721ca72a8f28

SHA512
89a50e07f794f5209c9a15b43425ea23a4644794e6e2911ee4d5afb1af02b71c5d1f7cb296c8adb5f58386955afc3c37ccb9cab75f354e7c2df7eac68bffeea8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
e47ab7ce756ccffac2b8800893986136

SHA1
3e40da2d3ea0073d0bd42f7b45717057c7e3dff4

SHA256
ef58a01a4d7f41796165ceba34a2081475fa03311dce381beef106b290acdf94

SHA512
fe6fcada669bf1c062b5637aec88e6ef958fbd6fc9af904d5aaac52e33204ffa33b8d650161ad8ce42c772c02dcc6926875c417c72e56a6a8f187772c4ca0dac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
9ffe5286e10a9de6ecbdd5b805e131bc

SHA1
bea2def93a181591f22bb8f7395481027e1743a5

SHA256
3ac3f92e07852d4c1e1004cd40bdfe7d8db015dec569a4c50b1c44a063e30244

SHA512
7c25e34ba1f8f8ab33bf9f1fcd94142b315e797ad3777f158ecc6fd6cf7eba31ab898d5dbf95386f006ec40c164597d6f6308432d1b921d7b4167ec80800a746

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c1f5e9ed-5eea-4a7a-9301-1f22e1007634.tmp
Filesize
1KB

MD5
88f8551941038ce69f00a9c01a704949

SHA1
8058fa8adaf547a282a45791b2288fc40fe23511

SHA256
768ce04e4749395ef396df2c8c907aa6b21633df993a0bffa6e1ab58349cd9f5

SHA512
1f2b86222671b13fb05ff542808254623234dcca11a32e0c154cdfbe6cd1410c923c32b0a04f1119e3cd39df52bfcb4df1756207d0b8ff4325c29dd9cade8bd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
422a36b2ceb2ac552407342aebf83151

SHA1
3981bd00f656a48b438818495f2cef8a24a0858a

SHA256
a0b6d4472d4b608c14a2e2972fbf5721aebb1266b341d5f4bce2319105e621bc

SHA512
78552a160e21653736eaf18e78d919e11d76aae32e078bdf12ba8afaaa7e8cd9551bc4d6c935063208437414deced93be2c35ca00d6cfd8817d177761919f9d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c8a6186493a1c22f50e44678613730f7

SHA1
1afd3a05cd4a3f3887ea52d40e193f7ae5062645

SHA256
4c1d5c559293a300c5becb67289dc9673057f383302ec3a000a7d82751fca88e

SHA512
43a4cd44ac407f59d027b76bf889236ba83dfff9d44b40d3cc0ec75f3ad27e40e8ff1ebfc058d8d2a6f58aa93440e8d7cd7e1452e6edd2057d03c935c837c91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
0efce11dc4b7702e7eb8c49b918d3b8e

SHA1
6b22f2a3d2f918fda98b6194af29693c2506bc64

SHA256
eb54c19752169a593b684a93e11fe4a1b1ecd99565ab3977b9e41dc718857a18

SHA512
eae1b704a835a9bb036cf9870678aacfa3d646b196544d4b4ee1e9132b4d144f597b907e88d73742ea9338cf75c9fe014b1730116c522c694523ac34bb7033fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
f852772a8f0719fbf0263e71c0c849ca

SHA1
abad6690923f3767fe49d67b12c48d69f4dc03e1

SHA256
2e78ecb5fa11572275f4aca6b798448171672a8b6865e30073b1307e1448eac5

SHA512
657b541bc1c3d46741ed12bfc3264c26811eaca750d6408f762c23472d520ba379433194d7fe580b982a6f1ac3f40f07d20fd3a9bfe6ec79ef0c6c996a1970f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
57e90bc163295da46c585e6af49a6fcf

SHA1
f27b51fe2e1f87ec0837a1fb7474316cb1433c8b

SHA256
edb12302189f1987cee1971170c8df495de2adc36d1dd9c521980943ccb17371

SHA512
3a4be882d8f20a22eb5d7130b5cb889b97de8ce0b4cd272f4daed8a4b7774f7ceeeb135e13a55b87d4d92d2b9af4bac4034cf9e5440143f76b14d0ff368e4a62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f9d9d207157e68c73bdd57dc464d2a42

SHA1
df987545133aa9d088587b5b5a452c406187d438

SHA256
31324d6ff61462ce56619d74dd6d38eb5103489276e55c96cc19c5f95b208d1d

SHA512
207d2c730503250c3c645428521189f985d65e15379fc1e942e2dceaf29acf59ce41ed7f95134931dfeaef65f91476dd9e4468abf91b1ccac27a6e912e0d1e63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f6421b6c68d669ff82cd182faa8cd12e

SHA1
ba65abb137b99ac53850739cc3eea8ebcc156350

SHA256
4b9372398dfc391f87eac6599a9a0fad9e43fb7f7c2ce83fa0615b3980eefbd0

SHA512
870d43137625fe49390909edfe51ebdefda0e46eee4c9f34af734260d5199b62667bcf8dc919fcf449dfc5505b1115d1ad4ff3c6036123e6df80b80979278662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
00f221c9bb0d770059d20462d5036bf4

SHA1
f93879a8d20dca018285c84099205cda6cef4f56

SHA256
bdfd740ab7266cbac7bcd7692ec4541e3683d9ab58a9dd6c2c0a43c5e0575f2e

SHA512
654472089f2f39f462dc3def093a8d3ccd278eaa8fe59390ab300873ba80d2f7bf0441712a4e796f70cb4cb93820fe46c79635d5ce60083ad515881b69ba4d79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
937ab6de05d9fb5ab67142ab7801ed78

SHA1
25394728e0e1bdc7df6b49898c458ce213c401be

SHA256
0716a7bcb669b27c1303f19b935477b6dacf35a85dbd80b1c0f162bea903cda9

SHA512
da5e111e1c3bc2d4bdfc39b22175f530cfecf5a1a534ab3b84d9f87c64b96ec58137d46c18cfb3e5f16dca3dea57813fdfdeeaa0ce5479b4490b0a320b7c6b2f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
28ae33aa4d3b63905b537f95158fa00d

SHA1
383e37830be05286265912e160a475bc9fe0041e

SHA256
6553aea8f8282afb463612c50ead84c1dbe29cb5386641a9f229a540beb29eee

SHA512
32c3b2d2c467d563f4e632b3c156537780389b81a952cded0614cc6041125e8c7b7376d5947411c0db5869f8742d8e1dc386504cbed03f35e87891d2250c50a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f1deb12ae225672dfb35c77e97a52413

SHA1
0699386691d8dcc0d3c4dbe3b6015f487f1ada8c

SHA256
774a618b141a9d3adaaf07562c0066658c5a797b28644d68b99b4ca8344a32d0

SHA512
18f89f0fff2304c1aae0fad3156452b5cac429ded6a854429d71e1031a02a9711783cc91703bf6e4ab42a73a47f7906b620f6b0c8245bb879533b913e1edf484

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c44b0e2d830755e3f11e30498a3cad97

SHA1
e09d1b89d38b7c3cd7a20e718cca0549cc9bc7d5

SHA256
ac5951ca1019628be8ae5bbec8ce958f01c57bc82ebefcfffaa0e8aa927f20b7

SHA512
5b072d8e6974eef0767d2bc3dc43900dde98c94b8277126ed7ad2f25c4f5928ea9791b2a55a9387e88be25e539511190da2a1b689603420352f0091aed3cf58d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
7aa33d4a6164e4470881c0def5e16b75

SHA1
5896147c9691eb8f20104fc2f7ca8fc7e229310e

SHA256
540e690194750e680dac527e0f0bd883af22aa8c54f36df7ad8a594689dab839

SHA512
5b30838c7a2cab75eaeed43226ddb6d9d5cfea134b78f31f47e1e6f9fed98af28e239a0e46d263de42e705db9e08ba9b44a27675b6b2b5ad1641c9c4195704ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
1e071a3e0058c5ade95266fddbdcb98b

SHA1
c38a683f89b4d6f62bd9e88f4c84482113a03f94

SHA256
040e7e35ba255c76b1e81751fe188e6cbb82c86a5774787b04a5b73369018b1a

SHA512
391b30e2970e9582d296466bb1a17d1c4dce781f47e2373bdefc635b545e5995470dc0ad2615c4ffcb749742fef7f0eec92ab3d787c02687d410ac8e40bfce5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
89eaa1d9b9d7ecf08cc237292f593797

SHA1
767cd674ec2a70a8bffffbd8cf369dba24c2716c

SHA256
ff31740e79fd56fc6a4878ec39f7dfff33184eef1cc931dba5933bf2b0b93556

SHA512
1f70e109c1ec6a616dad0a012778605fddaf9241d0a68e17c5671c870bbdd1105238be7db5109d8392f023cdc8414bfd579519a13edb665fcb40a142f1f1a7ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
a297685dcc1e719e377b461033cbac36

SHA1
c344ded36807ce74731ffb493b4755cd01c9a988

SHA256
dfa4a9df797c123d33e4a986a222b73d8e0fc88ed6edbe851fe7120fd3843cca

SHA512
60e87c47ee5a9d07dd5fbb95c2301990542fb1335ad3b6a8b0720cae154065609edeeeeb867cc0f3a63adcba582d560f90407025275488049a3a8894b99d31d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Filesize
348B

MD5
70edfceee90d8247b8dca744cc1acdbe

SHA1
960a85f5413f87eb6c79b923f69a946f38aea64e

SHA256
0f98f6b817dd05dbda6468ebb2ebe6c1a5e98f0216577765f9cc2e866b072f19

SHA512
dd65ac3b1bdd1df9ccc0b5b820db045acec85b16de5c551c54ccd94e2d5dbd9ca599039acd1676bdf706b6c87d93489d436ae4f2986f8eb513d0d5785291458d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links
Filesize
128KB

MD5
0d0cb30e638708865db725650bcaf4a1

SHA1
93b72e772f190b6cd455b2fcd4fb2ebe4bf3ff31

SHA256
a799d7b552307e098b7b2ebb74d598db6a1ac43bc72237e4c3e78ebb7261ccf4

SHA512
9e5abc6e991a2cb6560f66666d0d46ac1cd0c4b0dcce07654c45cf452d99603ea12a47215e55ca0d2405f035209d8d83f1bd8f2b61b5d23ffd2e1eb05abd02a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d3974d7f-9cf0-4049-a90a-28f9a8a1c293.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
159KB

MD5
9a348904ef55b54d679ba327190ccf42

SHA1
c4a92185a3ec892606eb8e6c8c2a7cc260eea897

SHA256
cedaf3864caab6a3317074e26eb9f449d39a3ce6cfb700325a1f7bdd81b61e2b

SHA512
07965e6d5357c50c5403343423bac394fd98a6ef58d315704d15efbc05597121c50a5a6ec92a26a7439a06e51b2abd5745310de37e8b37a003fec4dd992e79db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
693a5d3b21d312bf5691f35d17e4033a

SHA1
085bf35796e0190b380a3e64cac1e91c8ad60d5a

SHA256
59fa6a8412f82c09f376cf371b58ce0c794d3e115cb43682258cab774bf44ba7

SHA512
511bfda32cd8af3e6cee252f2c24b78ff8081fff4a9cd5d959d6a06728c2ea1941189765411e226d98d5a1c55264a6c11de03dd2f233a283fb32d65c5ee51a65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
53c7dc8384742bae68c96136768d1b1b

SHA1
9fe5055af6f91197a252757f49247c6e4b826b69

SHA256
b03ae492ef523810beeb41c68f8543df7084b999a054785c0e2f91f9bcf9be46

SHA512
fe2404d20b96c083146d39d883dfd216bf266d5679710c8576399eb1de8367adce372386df265bdb8731564c6cd0b9428bd9582b956c36f9dcf6c23e7bd0f786

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
176KB

MD5
b61afd6b842ce21ab0b5e56843f57b75

SHA1
72cbee611807c2388fb9dad50ec381183624f387

SHA256
7a15c9396cd53230a522a657e48cd356f65834be84c7afff6b7cc835a74e78b8

SHA512
0563392cd82379750f3d34c99f3cd58affa3858c07a121334e50499ed0af6edbea278eccc4aaa6180d06c6ca61fc18423a4d76d72eeeb49e9c94b86686df9425

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
150KB

MD5
4a069884f8b1e48a70b324315ebfe2ff

SHA1
fcf01d1c87a280846da8df5f5892ef1e44e5cf59

SHA256
39bb155768512d7cf8227a8ac1eef3bb2d3c94ce3703f687e602771cdd158371

SHA512
79304ab6a36e2f65d3b62ffa4609a7f4b845cbefa72618f1ec5afdfbe686fcba3709b7651f8f89802f2049243e1a153badfad06b8f110343ee90269bac2a3af8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
303KB

MD5
c4a043338e0b08ee4561af4ef6b058da

SHA1
d213c771be9a63df2c280dbcbd0ebd390bc8bb16

SHA256
a735eb5cf0177ad229f13220cd4f7480cb73782ec0743487fc94c1fe22a9f847

SHA512
d91bf993719fb4b9ca9ba822c226e4320f2e72cd36d06d197e53d571a62ebd844a3b2b0a07069e7dfdb4c930976cb7e1329c2568914f319cd381d788528ed4f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
303KB

MD5
3efa31a2628155ac59cfacffe8f7b9ce

SHA1
5962565b210f7e4ed0757fd464f2d74872e056ed

SHA256
9c811209ccf81a2d59a4a618ddf79560d08c9092bd3db4ddf99ad5a8a14cedc0

SHA512
210d8d0f8efe11ace970749a8fb7af79a7552120ea1721debfa90fa7eafc8c29a661d3304170630b3ea92393d226b7069fb4c7c1fb2cba1e0f9d2f680a079373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
3a92ecf8d21618824c29de08dad412bb

SHA1
934888395e97ad1aa13a9275d75c5b314d9ba5eb

SHA256
54043a8395054671f5669fb7e66e8fd8180e8f6f1aad424ea158bfa92e552097

SHA512
840ad26c2dfe0f72f7b7a2bd9e4b15a79ed994c996a969839b31f0c37fc1ca4c0bc18310296847cf389b56919c1c3ffb2f224132040e91976cbdf9a92e1fb57e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
bc792c207096f02549437b3f409a84c0

SHA1
199f9ce83caa457d01d48e3647611fd05dc73ec1

SHA256
8b852c93a622d4e23affb737042ab72e12a23c1191cb8ca61dcb24f3757d439a

SHA512
9c5bb2bf6afaf7877823a3db143e8812a32d31b5109a5ebce92214d3eef01bd06b0a2298f41f62f080776f0a076845c7aea8deadb0c68e26f54dccaf08b34da3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
1e45d11cbf5180657b5797984f03f7ab

SHA1
c5a6d6a200fb75070e0dcf21fd26b4e89d0d2c10

SHA256
bea3020ea1a4fc69fc783c541b2c8ee416eaf3476a427f0c5914072b90d3ed09

SHA512
e3e1571730f35c68dede02582f250b43f2d6cf7172095ddb716e3581426730a5f37a858caced26b892ca4a704f12d25e886d107aa68bbc03eb8ee2bd35bf9d34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
198KB

MD5
c7a3f2e2929793198c14add763d71d4d

SHA1
4a937ea78be0c492abb34534f5962061db3cc7b6

SHA256
9e07bb504ba1b2e7f1c91616cb58aa0fbafc9829c205ae69d7a33e30c3e2c533

SHA512
ad1a8d1a0deea7fe1a682fb63fd5f551a0a7b423234b5ae79dcf7323517e2c98a328b6c3c6d2f1132100d6af51aaec47ee71bea946c174b251de75720ed1ae40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
303KB

MD5
1bd2f68105f79113924db12d46c7be01

SHA1
694c83700d2c5267fd4a0eaa55f8ce96fa5b1385

SHA256
fcadf32cb335ddd078eeddf5767aa6baae2d6e5d9abf174bad4ffd10767245e6

SHA512
d49de2f95dce419613f44f6ace32bddb1c55899b1ade900ebf9146541a6e2c5ecbbaaf363c4efae2660bf28eb5966b0698fc27e9e78905fbd1cf5e34d0da3b38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
0eadb774e33264734b58f0bf846875ef

SHA1
116e6ca072be0259388c55a82f11a48a24914a55

SHA256
b484c20a637152e9e29e8dbaf72e3a05881f2d2a9fcf39fd99e25e7853d72c3c

SHA512
602dad11ab98a94cb9275985af9db32bbd65ba233d8c21c641b9905572d25dc7b2f269a779b690e7dcdd7cc0934e719543f24d4b2c6ceda4589c44796faa65e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
78517288d3f88000a433f661ef4c3863

SHA1
a3afc0ac3b17591469fdfdfdf599c9c68404f22f

SHA256
b1f3f86bd8c6fd555881ff4c76d1b9fd03ae32cd065ee8f972f5a982f658779a

SHA512
5597033a798fad23396bdc853cee913ffdce9c9190f5d8eb7d6711e7ed717bde6fe9fa93675ddaec0aca16542f0020ddad232573c416639b76fd147e6dec6446

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
158KB

MD5
e2ab7d6577938052edd05ed8a6eed4ea

SHA1
fd30568a6ed5fb6db172d144b2fe2af470dbb5a9

SHA256
8f21bb85a07cb04686e3652e12fbf385d14e02a4798336813b91a61aeeb5f1d6

SHA512
034303e51b94a6705a3b6ef4df1f2a1a07128cebd7008a13f8daaf853e963777d1728e9609d22bdbec238e72f52ea80150d6fdc15263132f0a707a26ab1d6dc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
100KB

MD5
9bae46e2f33f69c6937456f290d06c1e

SHA1
9af0adaa2031cd42b72d10d6309e7fe71b3fc73b

SHA256
cd98ed4da2874c9ff266a417b5a4156bcb7f2617102328eecb00c2459c414d87

SHA512
1a1c74e6ad5853b30fab2b3ae6cadac6b6bb9290e23100f335937b54a878ddde9c0e4309528bac518c334df699b528cc2e72fcc95efaa264fce2c39db3c10417

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5b1bb2.TMP
Filesize
93KB

MD5
a91bec93ff8abb4f75946d140e9d27b8

SHA1
66f111bc03511c45021b39109f4fc184de0bbb9f

SHA256
65b1786ac0e2666f3b7dc035a8c7845c4feaddd1b74c07437c5918c208259e3a

SHA512
7a2b101bb251f10c1736abd55aa8d1dafa0f4bca78bb2b96ca68f325c0ceee4afc3833e4087e7e2c16200c8eae10d4adddebc780f85a2d4d46db41a89867f5e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
591e485190375424b3cc5ef59bdd9aa3

SHA1
d5f522377dde526c146db82e912edf1f04d75d83

SHA256
2bb4f21f7303030889b8be1785a36fab947f714467cbd94f06978197f2242fc6

SHA512
9b7c159ba0050dafd1f76aa2def7e15196ac0f720ae85c4234978b34a0f94ba11a1ced0db10a4244ed0444b13906df56ebaac45bba5d5e8e04a7445308fb8802

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp
Filesize
31KB

MD5
25c5e5a1610b6ded9ca51ef69ec0c111

SHA1
11ba0d12e11783cc2a62b7a30e96af949963449e

SHA256
a2109a1fde79678c6f0f42d5268ba6edb1a95c51fa6f2e712bdbc33c0ece82c1

SHA512
c39c091ab615f1cd2fce80af5d59abe663fe90df8e0a8232f53bae1502a7bdb509544cbb91abefaf472069186dde5698d697c16f01c224f8b8c12a075f95167c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\02AB3BAB64F62D70ABF963C54F28A33F478CF991
Filesize
60KB

MD5
596c53f8d6f2311df01181c6846c22a5

SHA1
d19fd739d808a2d03c084eef83db824be462d4ad

SHA256
57e7f75252315c67edf0634b4396011790780c25619fa94f2cee1e2de6b77df3

SHA512
3776b7dde3e6c5e2d4276ae03f9350bb14476a2f311819763c13f6b9ee4bc1893349d27d6c7c9ae82766fdd98ae3deea448023149074e7c2d1dbbb85edbf7bdf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\5B23235D54208C34AFF88FC6F18585FD8A8F8FAD
Filesize
32KB

MD5
df113bc591bcb21ade0232bdedf9eca0

SHA1
312c649e62b34d5db0e6579d3ee59c48fd6b77e0

SHA256
73867c9e722eea3cbe724c23fab4c23dddda19c385306a08c62e5c4c6631527c

SHA512
babc7076995e624b212cc4a5179e813a944c863403d8c714d0e489ad9e15069c473dee2ad86886caf7ff3428938a83acdb357438ac61e9bd8d4563721feb26ff

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\8A2C4AF2A1269087DD64B2D56091D00CA9E7F073
Filesize
121KB

MD5
a9ff5389c2edbd1118b4c3172e717770

SHA1
c9007ddeb355eb7b30b27af1a4b6f220f452bfbf

SHA256
2df826aeb4a43ff917146e20b4ce6b074133e9cc22cafad65e16553d6672a4f6

SHA512
3b002fb91ed54c3953987ffd9d663869c4d77b9bfe4a6c776d69483526c0835792d6093d64e0c81cd9955979c49e99af05fe4bfb9fabfb3ea27ba0221149e32d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\8CE66DEA22DD3A42B6A5076E5529AB3269646214
Filesize
31KB

MD5
9b17d29d17cf79c3a1036da538614823

SHA1
31f0143487264549fb31b865889443ab4a3afb58

SHA256
0fba4366959db31da0b66b5b370d9bf7ad8ae88ddb0d49a5bfb87e45f1b96c39

SHA512
3c11f0b757298530368393f37d98036ef220501deafbdafc46067162509f50008d4360882151178c787b561ce7eb55a08e47346dac706e49bf863d0c538931fb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\entries\98548360A42A21A9012B7B8CEF232AD237A057C4
Filesize
78KB

MD5
f7913cffdfee1ff62c84594e0979f2e5

SHA1
d03273c29fd793732e3f2bc9d4e9ec5a87808db3

SHA256
10188df2e782977f0b1548a1b5a9acd102f90643fca461e431f4688e6317c548

SHA512
2f63f35adc2922b7208bb6b7a7862493c597ccd2648e69b5d034831da4dfb892146bfd62161f7ffa2630253e0111ac2999c9e8ccc9166099c49d30cdd922f597

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\index
Filesize
11KB

MD5
8ce91cd6f5100af78b61e8012bce8e94

SHA1
bb72124c8be1620dde5f983121dfba0a3c75080e

SHA256
585570a92d241d68b4fb5af5946d4a734e25a9ae526fb47a7b333cea32d0572d

SHA512
28dbc34c8401f383433d1a994c705c9cca70679821f36acce744fba24417d1baf3800c1ee9790aa8e1340e9557e12f275fe549425e8912c772a339033f6f9702

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\ads-track-digest256.sbstore
Filesize
1KB

MD5
4d7dcb333f321fc935974aabe889c079

SHA1
4e58f08a1a316e6907e852c6f096fc31f72e3e22

SHA256
905bd314e73578d96aa59089fa66fbe905759ba9a2c8ceb99f0559a2b2fa7355

SHA512
be1abe9d41de7d4ed8aacedbcb7763ce7ebfe95aa2fc614cba8b6fed35927e01d27f5910504cf3cee49a837ee2bb6b79ee831436fbbcbfe62832c662b3dd85b0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\ads-track-digest256.vlpset
Filesize
54KB

MD5
4f9ef3d3a71d4cb49e623e3f4b7b1162

SHA1
c2d65973b44b051d043475e9387fa7100514acbd

SHA256
48ae004f3c542ac764dd5a1e894918ec4b250b5c1f7209256c191cae13106b1f

SHA512
f7017204ad37ceedbff4e8b58ab4edac75748d2f36693e59ea9d9157f637d29b53c6405d994ac9fc62712f2574013e95c4817ff49229c78dcc23cac805b13ed7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\analytics-track-digest256.sbstore
Filesize
558B

MD5
e15b0cd7faed0836d20539cd1d5e6488

SHA1
d18e5aaad664bc1b67fa7f694aef12167cefb809

SHA256
7506bfbba096fd71f7ff868ba1b70cc618ca36d3215c4ad657493cadf070f54f

SHA512
16c42db2b2377505baa43a445379f79467950ab543dcfbd02538c983095e20e0d6d5daff34c92e242a19f48efe53df070e9c265fe70d7aa6bf45bddfe36695ea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\analytics-track-digest256.vlpset
Filesize
9KB

MD5
fb3835c20d4a35f882ca3f0fef00c536

SHA1
e0dbb1500517fc57b582e265b3b6b6dc2cd26bd8

SHA256
9a9e184a25a9faaa95574d797fb6066022f030ab1f9ee57471c98fba3409f6c9

SHA512
4b03ce9f24f9a15ab8cd4592172da5e229e5775d1b89553b368ac38202dc23d7b1e9b64babec0c7ff7223ea6cb8235a5397b01f7b39c094444dec9bef10a63a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\base-cryptomining-track-digest256.sbstore
Filesize
315B

MD5
a17fc303aad48caf4a5cd48a94f8c006

SHA1
f67ed30e4c89d737d0671202ba611fea2b74f65e

SHA256
8e008ac435ac6391311993417df2e5d5e0f42e522d7bebc9b54b7efeaf0d9e3e

SHA512
da9c066ae40b71a1c000496d5391e8fca0338cf0a021789861cf15108c1bf4df656d064f6364727dbbbcc084fc4953d2a9ca71bbda30de8dcad732fe6decda32

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\base-cryptomining-track-digest256.vlpset
Filesize
2KB

MD5
2aa052b3155aa15a1b3fbf7646994df7

SHA1
8e0a3c6e7f6c827665b9bf6b014635e4652d5833

SHA256
1b1922a3c859c691e372d28b32ab0573684b288d1dd71a6837fece58b2b8d9c7

SHA512
7a40ee8dde7a4470112e703835421b72280730929cae24c01dc098de40700be9704940fed463fd8182b63234a28bcad3c11a81bca36568d975ec4cdc413ffab8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\base-email-track-digest256.sbstore
Filesize
462B

MD5
06f39d542539522dd6a6a3892ec60429

SHA1
54d45ca1d42de43b2f915f1a6f63f00def8b6c92

SHA256
477e14a51c019fdad15ac343675ad920b3e0929b6041cf3fad506f5800e2c2f2

SHA512
4a7bf86a3d576a322603dd1f980b1cbbebd23206c652966333f640b59c3385058ce58c247741107ddc381b5a770b4e6dc691e35c798125811c970c73f33dba11

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\base-email-track-digest256.vlpset
Filesize
6KB

MD5
a327b128741ef8df72f89c6bde6c474e

SHA1
2f15b5dd33176cb41d61634803c8aef4698dec46

SHA256
9e799bc1ba14e034760b7f1c45b8e09e9ef54759df14da0cdae93a6c14d1e276

SHA512
60a50b78fdcd18d9622c738645705497ee3b1af40965a60a0151f465e59a9b62d2ac1339f8e121ad63c1b02cbd18047fe1e245c59af44f4d19dd8b71a442db34

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\base-fingerprinting-track-digest256.sbstore
Filesize
353B

MD5
26bdc8488fe803acdcc9ed99fc4d41cd

SHA1
884817fa2fe0b8c7b5e472763d748dc58ce3b1a7

SHA256
a5b0f5904b435b52a1b233ba06cff2c35e06cc307d0e978a60016e10554c2a62

SHA512
308803638eb590bebb484d1051bc1fb6d996cb7a95c3ab35a31af335d22f1394f2f07c9a9f440a66612a3dbff4735a7f99360b799c412be954626636d0fc7930

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\base-fingerprinting-track-digest256.vlpset
Filesize
3KB

MD5
a25936302c242a472de7b2db75f047de

SHA1
00c2e2f60b80229b87808730345d34484947153c

SHA256
5035dbba6f06d818cb5d45de297bb2fbb9987d4ccba3eef5e9e9a4e663160e12

SHA512
6b50c0c9084059a1814bf9c62453e230cfb7fe1d63dd4537d7df66dd4e53ce20430c0e4074bca83e93f300d42521d2b1f1bfbdedbcca6fb78a0341aa78b3690b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\content-email-track-digest256.sbstore
Filesize
429B

MD5
37bfb646db8933d46f8d464ec12ad26b

SHA1
51ab2be5edbd9e663936b95f61eb72d8607f61c6

SHA256
27ce000aac32d51fc2471f36d2916a8efa3e27f2baab733a320e6b619f181efa

SHA512
f5eb7545a482f1b4ebf1a3933aa867bd87a6c584185470e8cff1c4dbeb6d26f448891d4166e3f7ec25956df3484eb306927a6923c5aa7c142a2c68d773b770a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\content-email-track-digest256.vlpset
Filesize
5KB

MD5
39a00a3e413d89533e22c82946a4a14d

SHA1
a37420f2cd29bce3829d8be3f2015efbd3060a17

SHA256
da64f4f25bbd168287d1e580412ce400e1e22bf1557f3db19f4854dd1aaee7df

SHA512
d6e4e35f864759a8c07c5ede8652dc2d4b796b10317660ea23edc5e94be31ba988818ff916cda1df4df3d1b2d6ef104e59bcadd9a8450ccfefd2871ec2975238

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\content-track-digest256.sbstore
Filesize
733B

MD5
419a733dd08b7329682b00dd2a5809e2

SHA1
ad636792a77a80f0b4337960a3fb7db9f524ba6d

SHA256
49f90ffa5bfcb0c02b79ddfaf95f979cb622fb6570730a8c7601f8bab17b6d07

SHA512
a69d125c6132ecdb8b7286ae7c88ca7a7ab9b6a68d4dc6975bab6abe4110d87087cfec8da91a362ea8c4784d734c40495b8011bc239984a5b5ec9cd1ba9caddc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\content-track-digest256.vlpset
Filesize
15KB

MD5
7b5a39ef0b6352647035b078013f0ee7

SHA1
eb61b88937695f494c2a28632abf4e49bf541da7

SHA256
c45025cd5e71879dad89e6d3cfc389714ab8ca9c79422a9a17bb5a73fae65a44

SHA512
7d52d2a6cf2a36d6cce9e7bc1fa2281d5a7294ce1ee3ea84880009c7e7bc9e0916c9d3365f9912fbbf96dd609e5df6e429ef6af9c7f56678a92be97c428b36c6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\google-trackwhite-digest256.sbstore
Filesize
45KB

MD5
7f2f8d8daa51d08fe360ed8488d55785

SHA1
7d3173f850df9879647178e1f5ff31f59cdd03ad

SHA256
5fc80bd417bd4dba8832fd25aa69ba4013a136abbda2d745ea00b0b408af5062

SHA512
bc46a24d30a1618481a26ae5f88d1a0365953c27c72c4828e84a0b927faf05c8ca8a4af0b0a084124bd3d3dd138bbc604d2575adc8190f9bde55901664f7eeef

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\google-trackwhite-digest256.vlpset
Filesize
1.4MB

MD5
e54e5b84194eee15e64d2a03f1136bb7

SHA1
308413c74a49af1a575bc6f64fea33f9ad2f220d

SHA256
07707b589be3dba3bb0bdac67760a2b180ea3531e9d7976b73e4c1d8df9dbb1e

SHA512
f3bae1816db808c69871bd1a059236bf57982e90da5706adcc3359a200f1ec2c529be516be629fbdb5e7da8c3ea80000815d99c8c2c347440cacd9237bddd3b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\mozstd-trackwhite-digest256.sbstore
Filesize
10KB

MD5
c37e2f8225112f4dd8b2710b63567212

SHA1
2f763274a002d1aeee5866257877fe13b501e384

SHA256
ccf9ad531a97bb490ef6aac069f971390ae95aecad8c1860f2e7801b3d2cfa5e

SHA512
ca0309faddc78f866cd78467a967ed68ca6d6df02bb0742eeb5e5b6b749882e674925ef55d5462a9ccb2ccc4a275362c273722ffca18b34aaaad045b9155f1ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\mozstd-trackwhite-digest256.vlpset
Filesize
323KB

MD5
c4ae76846b04085c82bf9f68cff8a78f

SHA1
07dd0d983e777feeb0371eeab627e66bb36f43fb

SHA256
8a68286b5a34d40900495ba611bb97159843a85e1d1aff0fc466023f6969f1d0

SHA512
67af1245a34104a22e7d421ec7d766f78c0b56f0ee45455f4a167266fb89c31a706b025abb447774638c8c0bcf7619b9238b5d8171d19247c493ea939b5c2f05

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-track-digest256.sbstore
Filesize
310B

MD5
863c344533e8c686c3c988ddfbdcde5f

SHA1
32599d414d7c52f2b7513ed1c2f5f1e706a4965c

SHA256
0d1a965e25c8a27462a85e35c028226e673032324c8610878207619d22f3a2e7

SHA512
0ca6a54bdf3fd9911ba2266588e85c42eb12ba95505fafcc7f751efdbe534cfa39167c9f990a67b97a6840d3b9cd709be2e80162b06b5a2fa475fd4872a27cd8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-track-digest256.vlpset
Filesize
2KB

MD5
03789a3e2b579f33dc32d27804ba4d02

SHA1
cd27354a54a3a62563039070a40fe106bb2e90d0

SHA256
db2e80581361df60e0a2b50b0593b209c4c3483be5edd04865841118f8ab0b7d

SHA512
790058694e8ccdc852238104a7ce14c42489450b36c4f170c8de99a35f92548625c2fba93d987ab77de7f3a668fef74dda9381106a8cfd4b3f2c56ee98dccbd5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-tracking-protection-facebook-digest256.sbstore
Filesize
255B

MD5
90f833bb4da71bc55f77b4cd9d21c38f

SHA1
41c2f30250aa51cb34275608a321bcc63ed8c84d

SHA256
2b4933f58384497d9bd8e0067717a25f4d733356b43c471b0891f31484ec9ce0

SHA512
d7831134ded34a9d3498c5bb2b7c1673e36e26dfd900445a065f4557faef31a1502fd0ab7e37acbea41e602d9f10ad8f6b88b81c615e93d413a75c55bb836c60

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-tracking-protection-facebook-digest256.vlpset
Filesize
485B

MD5
60c67f500a7b4bc576f73507ef426147

SHA1
a2699874806ee3e92f3bc3edf3d8f5102be5e258

SHA256
083c83ba2b3eae9b257d389d5f1ccd3974d679a99b9d85a37987ade054f360b7

SHA512
016489d491631ac70dafa94d991834819688ecf71f51adc198072c3200fdc71f7805269cd78b6f6b848b43ebd7048a5c4b090527298f2549cd2e7cc508be8d14

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-tracking-protection-linkedin-digest256.sbstore
Filesize
248B

MD5
cf0a2bccce71fce55caabc54b9b92601

SHA1
e9b94a35c21e86d23ecdba76a0d56f4bf524b854

SHA256
8159527a9f7d56c7ad8154876b9e268ac9f5c2d0e8c98f71accaa8f7e1d7260f

SHA512
b439457253e5414338aa246ed642393bbcb9e6b867e19fd7b5ef707d7861af001ea45066d105178505292ef112db382154e4bcceed1efb0c536ff20506987b94

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-tracking-protection-linkedin-digest256.vlpset
Filesize
165B

MD5
abff90a9c34ff495667a7bfb9dc790a0

SHA1
c23b9ddf32ece7329c219ccb5022e3a6c2794e5a

SHA256
6a32b1715273c1a5472959dc55f1abaf413a9213a4072aed9fbd9daa39a4875b

SHA512
ec3ea8c4f4ba35cfac2e6b0b3c6f4f8ebdea3733c50f72930fc1defb37bc04e80177b178abc16d9ba4ecc725cfb69831e5727cf6935fa2e4c7d8e763b0dc6a5f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-tracking-protection-twitter-digest256.sbstore
Filesize
248B

MD5
a0b396f1dde60ba1d353cab446ffd1f3

SHA1
cced02874226013312024e6184518176f8b03162

SHA256
889e28d4bb09f517e2d2d50327e9d19900ca3a23cde4fd81d7e82b726af9066d

SHA512
62c6ce88d66ae93aaa0c1e90b02fb8e12fc3a582d3e3e177d72b0150adf447a73cd427322168daa60d4beb525641ef4b51d52616e6cbfd79478597468287cb0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\safebrowsing-updating\social-tracking-protection-twitter-digest256.vlpset
Filesize
261B

MD5
39e363f1e60c2429ba50f0ddf8e960fe

SHA1
bf5ebbe6909bc93a7766ba8f772e983c4ee5b36c

SHA256
62d7fbcc03a06527a57349d055fb1a36029ac5246f4a62fdf03b93112af8f122

SHA512
e77542d38337de10337566d07e526370303619df2b542be369480b7174f53a351bb44bc440c65451512dc441f01ed69a3550c1628af1c359792d7a01ab9ac679

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\startupCache\urlCache-new.bin
Filesize
2KB

MD5
092fde43634265d182c6b6a5aa4507da

SHA1
1ca6d3d05aefac96bf4b03d347d02b3b3891f335

SHA256
c01c13f00b974324e9493ff9106e0b1478bf893f3e9873653af8f238617a52f4

SHA512
939ae6cdb2f001d128e49fedf8fe29e8715ec79f75ae1bef7a46d02ee13a29308c4bb0dd98f143c88a6a1057f970e89bdd519eae7e755945c51f4a6682bd1aee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
Filesize
334KB

MD5
970211af3cccda80e4db355181c57e69

SHA1
9d1db00434ba88ac9fa8707118b8a0a472bd7b38

SHA256
023c2f99f1c15f6973bac13db1dbd7b871bc8ebcdcc9946ac0cdf8c852f25db5

SHA512
3efc780d3f3102920e09b4d838aa5c6ac8c95665d881982fb5c6055ce0c7ebd83c160aee15961c1403000e2a79eed76e2b83cf3507a92401aa003750f0a0a92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qxnq0d1a.ra4.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Filesize
4KB

MD5
98a16a0eb626df0bca0942629e2d8c49

SHA1
a6666a6575687523d71d8503d9293763336f8121

SHA256
5ef76a72bdd79026c4194aa97a632c21c77356ef0422ec86b6662b1a8a8bf7eb

SHA512
27ee53b443dba0d75b6ca9d4ce161c89814a38fa709a6048c70c691078103bec3fe8dac436b3e767070cf497b3516a693d16a843f08c54a1909468fbadb170b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Filesize
5KB

MD5
db52f3d0e640c150e82032fed6e6f66c

SHA1
381e9a5a7237a1e1f46a67320acdb9dfe6cf4b4f

SHA256
b7bf38309ec117965de8ceb669db1c428af6b4e86ed5a50518098866b5aae1be

SHA512
6f9609630f12c0d029de1bdcdcee5457ad10d745691124b4c31a8b25cd61014aadc272707b923f404ad93644a9990dd542f27badefa5001ec0031783545af1e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
36353754e21c6f9038a5ad47ff846c56

SHA1
6926e651647abbf2ecfdbdd544405848a86bc9de

SHA256
5039c39644ad1e0ce34d199abb88a6f135a713dac1a99355968fd4e8822d616e

SHA512
481c5ec390b366e6631896e363ce5680afea2399a5fca8f5e0161589a44c516c1ce0e76d24e65ed43ae5807125d0b56f123aa4a20e8abe620aec763a70bc4e1b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
0a86c732fa761d51cae158ac061804b7

SHA1
23215a072eafc97285af9b7d854c99f78db8287d

SHA256
f020bb3283f67946eccbdeec2e4066201310e36b785d7fa1093ada21f8257743

SHA512
471c5e7de7eb74dec1d440ad115ecb32cf15ce5b9c225d43389d6913b5c4fe3fc275fa81c812d6ab8f36d83f62d5f5e3aa023f7d6bf1594a22aa3fdf1fb8854d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Filesize
14KB

MD5
904416670f65869ee2000ea288fd3ac8

SHA1
a1a379baea9f80c9304c643e23ab8348ccec4e08

SHA256
56048c112dd8776661cc86ab31c54ec3a4028d004f22cc9f59ab83b67f005f7d

SHA512
8cdffc20d81ff44814c8e5fa79463749a5267ebc715dec43c8ade4d22bca76057126d4edf607e66a3cd85b1bf7be417de70de6f964c44ce92b5955fba3d48a25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin
Filesize
14KB

MD5
2a6e92083b79eb2af8d3a33b336660d2

SHA1
0ff820d2f5d8d81c4413bd81013aef867003c0aa

SHA256
72cb121a11fb065f785ee64d66548902c1486b98ced5e00bf26c0ffa7a2b35fc

SHA512
04a88ce366063ed8357eb10e09a80538571a9a2cd7fed08edf0cd22b5f35703a227bafebdf75bb5eb5c004c9f5f17a61b2a45aee8e541548405a7288725f47db

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\05b8d6f8-1788-4ee7-80eb-92bf3a5abdde
Filesize
746B

MD5
a7a2c75673415da41a0434183d809b2c

SHA1
bfa3e3ba9e8201b004a3fd86e7f83f73f0a35377

SHA256
14bd57d82a626d3b5d6d9783a568e6e5b9b5465f79c649edb19b5853de4f8f39

SHA512
16d7ac31b01e9ce665f7631587723837f9ef0d40167f7d33b66381cacc803395de2d816bacd500fe8b7086d346a85fd9b460067583ac71012fbfb20d37ddaeb8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\371b4903-4525-45ff-bc77-c286d64027d3
Filesize
657B

MD5
2eee9c339aa2313fa62994a6636463fd

SHA1
f8e65346bebf13d7a64567990dfb5fa8797abd05

SHA256
30dcf274cbad0a62fa4e5cf500a6649b6b08f2f0fbd73bf91bb5ac6120811580

SHA512
50856b581520f575bd60a694d43ca1c823ecc3fd3b5ff2328d46b75c342b08636a746bcc4873f23638d7f663914ba7222e9fa23acc9dec9779e3f6af21aee45f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\55a1eb70-85d7-42ca-ad1c-2461928265d2
Filesize
734B

MD5
b41eea0c48a616316a1394435cf55346

SHA1
4f4ad8b7394eea4ad02db3acb8c8a3be23253ccf

SHA256
6d0937273c7ab1a0e8e95f3336d19e6ab1cb17baf284e1b49d97332071a45eff

SHA512
9a4188364f6273fd6ba6a3f37e01647b29669f0c44a16f97258f8ae3e3285e575aaeec63e439b9eac42ae911e240f1f0e9f15aecdd744fe95c66486000f44038

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\7a29d2a9-5a69-4df8-b6cb-5b2b990a1d22
Filesize
657B

MD5
e6deeea85fc077f2c40d95d908a65e02

SHA1
63c81c3aa294d7414ae5f5085e5948a1e4c8580b

SHA256
70e0d9afc0b7fd61bdef8830b9a6bc85f1b42f0ac3662de9651fe0e4692e8e0c

SHA512
c115474261c4a67ecd6e33420d61918c86eee8b99da38d602b1f9461148457c87cb499d8e5fe084531e3dcad81ca704b814ea16b4bf2c3323e329c8d418b63c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\b5a77ab0-8628-47a0-958b-d4d4f93c49a4
Filesize
714B

MD5
0c466df3ee7d01783cb4e6c69416ec15

SHA1
df3722cefe84fac3da738050f084667bf06ffe3f

SHA256
30b06652eabf15b2ec5638f0b199f65d688ac5537c4803eee63bb16b95c99862

SHA512
4c7a879fcd17657321f9d1cf1319ac3ca6168788adb20dc0eb5411267d72ece916c597aec9baa4ab45d3f412b25001060ef169b30f48d0c2a872227fc14c6688

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\bc9f6b41-2269-4c58-ad1a-cd942d58ad04
Filesize
10KB

MD5
1b84b9d65bfc6da2b0fe6ca6176d3353

SHA1
1d0c842b9d56ddf70f06b668f7c74ab3c4b10553

SHA256
5c1b4e10c0d3a6bfa6da9d36bd3a8721582e3f97bd0680904d8b5f169416daba

SHA512
7049d3e3e314fb632b64aa96dbb870aa1742c8d8f148465d546db07b5c927a91375dad4644813bd1433f227e7c767255bfd8b5b7b1c73cf7e19b6c0b4ed72734

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\e9bc5739-8eac-456a-9a61-117b398bd6a9
Filesize
1KB

MD5
e303defb7509caf408a37b92facc0a54

SHA1
3f3f521f3d930742fe0d526bd26a9693f1dc23e6

SHA256
94f751f9709b70ffe5d09dd74666d003baab905494afd612757f09b12603f577

SHA512
73027f3223ffb2e9e3519799919edf69623e2e44ec93fb20c284304079633e5f435256203ca9702f05606c1a7f7cf48906572d4fab4fd713dae9d0e178b7090b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\places.sqlite
Filesize
5.0MB

MD5
11bf61bc34af11f9fb0a984c9143e31e

SHA1
e3092f6a5eccbf3768c3337ce34696c294b93e42

SHA256
82748357b893abd23ea738231a598fb00df87330bfa54a86cfe3dcab84cd2f65

SHA512
ffdbb6f951dacdcc516fb97f502c21d86bbf61239b7b42533281a331855d96e84a9e3c56b5984efeb8988bf57b4a0cb13f9176f15f67c18119e410f3592265dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
1dd3507c220acbd6ad18f67c2ab470be

SHA1
c4c284460baebd15e7e19e2910235c938b0f98a8

SHA256
5e782fa5ffab79168becc52a71559063c497e9701de57b4cc59c08030e2c6019

SHA512
58d61b78de5abeb2ca21db80f7bfd9e055ae52bf5670bcac9a934bc5ee138d4eada5c4c4a2665447432f21b4628f3318ab28f5fa9dedaefa4e10188737b312ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
6ea526a27a94668b9321b804b9529b5d

SHA1
624a41a457cfa12bf565ed552faa38fab23806d8

SHA256
d9a227c9b1dad12e44b0f2054d215c309659dade355b993cef52e0609f431a2d

SHA512
1e663df0c6eb6e5c077ba79454ab3e963c72c885eb1199e670bf9abe0dc3894a194c2725100d8192453379eda22c5cf22cd0f3b047ad3b05c9c377ab07b75f5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
ae88bb958da51867351d521a2f50ddc8

SHA1
d5bcb9b819b8e041b95d353ee93702f085f941c2

SHA256
5c7e04aed90ca5ed0ccc6b862e7ae1de5844400eae8a0b1fd7735fa3df32905f

SHA512
d5efc276bacf260aa66f034b4a6c68f48210e44cdba8f32007390eeea677333c7090d9208dbeb700d075fd333177d134074c87b34354af2db4abe9dde7d5c9b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
2ad5a21c7235c970bbe5c24cdb4a119f

SHA1
796d20c3b52c25fd4a61e160b0bf996b6cbd6f89

SHA256
f4d7fda7c59bc1f2589c32883d5a2dd2c1ee90247508b7a74a9139d41ba3c820

SHA512
b5f8fdf0db0dfe83cbdcb2b159975dd03e93b853c6d53e7174ac8f64f1a50fd23f961aabd8b25692c5720f2cad97d8572f3b5f0b3d816222f0c4fcf367129c8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
1038c33cfb97a959f64caaca67317645

SHA1
d281ce2a56b104aaf558e708919cff5a2ae0bff8

SHA256
c48972ad2cb85045e7514fef3ca0bd9bfd5dd6cd6f92921376e2bc8fe9ec6700

SHA512
85d0f3cf2362fdea62172138c1e9ace8a273f5c2dcf9c6ec60e085f7d8625a2abcc04652de68c5fa0e95fc63e1eb10bbfdc7846ca1e4738ccaff3afa6aabd650

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
6KB

MD5
01a2d7df42a25f907a76c46bff03d3eb

SHA1
e016554eb3a21efbb1b49545bf5e685001756247

SHA256
b520588f5bd3eaff25259bee3baca38711fb8fd81982d5ec18f5d2bb3a56c75e

SHA512
8b8d125cf7743952ad45d777aebf778440f23d8480c89804e75d50e4a951ba61f89ba2c06fea0ab2a085380d606bd9ae0691b9af79864576f6d2a674205e6492

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
6KB

MD5
2f760f728c2e040d70a312c18213172b

SHA1
dbf89b0af27fb6bdf6d8fee9b4153611543b6686

SHA256
8fefd743be6f27191f79f646843188ec946fb17e7b4e524ca70f24d998afd5c6

SHA512
286bc7a3d8beb8606e61b93da3154e6d14d52846aaa1cf38ff3929193cf42c1fcee647836ae273327e45d3655def1f7089e9aa849da5b2d7d99d8bdc0f25fb30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
c34b763c389cd21b467fadbd7776cfa9

SHA1
1adf895dd755874fce5841bdb3f6c883710542f5

SHA256
ee6abb068df2c128213b85f563de0fb75aca03e8156a81074146ff19315ac9af

SHA512
a63d128e74748123cda1df1995ac57904a6a7653354ffda0e33d7ff8b08076704245153cdc123ee6488f664fe7f5d5ca4d28e317303aeb12cee450e765c377b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
372b38a074daa4beb7e99a58e0dc0b21

SHA1
987401cc4db0574fc616a86a6ea7e05b8f610a0f

SHA256
342ee217e3e3976f3feccc23c7313dc6cb7b3e2414cf3321d11cb74f3824ff25

SHA512
9d68d8e59e47ce76b706c15bb7092ee79fa6a13d823213fd0dad64f5b59b2581bcf8b876c50941b460dc809876e5c53605992f7713e7a1a6c52dc743e3ccd34f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js
Filesize
5KB

MD5
89d2a83114f7bc17a7e88a59ef9f63e0

SHA1
905387aaadcc83faa497baa80333e9dfec454b2c

SHA256
ca8c777fe4ffed359902ef87ac270c9bf2b58c960ee61315fe7deba2cf0c4dbd

SHA512
a141f72ca97218055871f0c849cd90676e9247de6aa31247157b691bd52558207b35fea32ccbf9e061975feb301d1c368699458224591fa4d8e0ef1021941920

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Filesize
6KB

MD5
2ffb7c71ec829dab26b42ab81b3016e4

SHA1
070e81b477af43d591a4d7cecbbd5efd8c2c91a1

SHA256
310c8292812596a3e33487b7a3d2c60cf7a2a8b33d8379a5d44fd6b576d54dae

SHA512
c875a74aa56f2b03a83a7f969c87d6a496166d7c13556304d4a2fc84a95be2c5e930b8f2e8ee78d42849a757ef4a29563ec73306b65a904d0365d515d40fd9b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Filesize
517B

MD5
ec11851c6271545f84fa53b297cdafe6

SHA1
944c71304c330e39f0fbafac3ec398c607d90a60

SHA256
1cbae3e59f39a8ed18ca711d3dd8e6cdd691d1b1ebde67387663f1a1b242af22

SHA512
237637163b9f44a9e86ace60ed6e2f6e82f252744d2f8e0f9cba4d1b157abbab0bab0aa34b521d1080830db529a8371081a33e22b7e4ea81574b141b84c8f48a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Filesize
6KB

MD5
3fe5cbc52b6bde4ee9c1cf9715c7450d

SHA1
823011d29ed15b7ed2ac398835a927ea62443ea6

SHA256
2c42727ab452d290c8b4243d98df28b862cb91592c11d034b4973e4365210928

SHA512
dca7988e8865c4bdc5d3dc8064f217608779706cebb73aff544486e397004d7048bab8683b0cc6723095f28f83f025550cc026fbd4d4a61b29f76dc0678c90d7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js
Filesize
5KB

MD5
d1cd715ab573764c8c51354af2a8ded3

SHA1
7e4a426117811e0bc934a264b6af7db9a5ac07ad

SHA256
0f9e62794f4f8c6414ea13a4c1afb0e9a08131ad99828cacd2af6a3982ec64f2

SHA512
47ab7d5a98ab850805f8e4046616ccd534b63ab8b3e30c19084ad5a736e811bf325667d8d712c193b86dc967a197449ceb70008d721d46ff85aee830850b8756

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json
Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
193B

MD5
2ad4fe43dc84c6adbdfd90aaba12703f

SHA1
28a6c7eff625a2da72b932aa00a63c31234f0e7f

SHA256
ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933

SHA512
2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
181B

MD5
2d87ba02e79c11351c1d478b06ca9b29

SHA1
4b0fb1927ca869256e9e2e2d480c3feb8e67e6f1

SHA256
16b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524

SHA512
be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
146B

MD5
65690c43c42921410ec8043e34f09079

SHA1
362add4dbd0c978ae222a354a4e8d35563da14b4

SHA256
7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d

SHA512
c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
228B

MD5
a0821bc1a142e3b5bca852e1090c9f2c

SHA1
e51beb8731e990129d965ddb60530d198c73825f

SHA256
db037b650f36ff45da5df59bc07b0c5948f9e9b7b148ead4454ab84cb04fd0e2

SHA512
997528e2ecd24a7e697d95cd1a2a7de46a3d80b37fd67fac4fb0da0db756b60a24648b7074255dc38f7651302f70894a53c3d789f3d7cd9f80fb91bd0cade4be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
288B

MD5
362985746d24dbb2b166089f30cd1bb7

SHA1
6520fc33381879a120165ede6a0f8aadf9013d3b

SHA256
b779351c8c6b04cf1d260c5e76fb4ecf4b74454cc6215a43ea15a223bf5bdd7e

SHA512
0e85cd132c895b3bffce653aeac0b5645e9d1200eb21e23f4e574b079821a44514c1d4b036d29a7d2ea500065c7131aef81cfc38ff1750dbb0e8e0c57fdc2a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp
Filesize
122B

MD5
99601438ae1349b653fcd00278943f90

SHA1
8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9

SHA256
72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a

SHA512
ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
454182cc4d766871575c814496d2316f

SHA1
dddb39e92db4cb00d6e5f750ca4c64cecfb2c572

SHA256
d40f3db90fdcdb9f53788a6214ee073b8fc8987404232c3ab27de1ba7a159884

SHA512
b1f53c70edd48f07fe5c912f02ebfaef328de126b70abd14a0fbbcf38f13d0b1245fc60a9476e267484c696ece724340d0ece46d7d9d140e70037ed95152783b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
14KB

MD5
3e4d300a9e90aa1343c92bef0156e8b8

SHA1
369305ae4fd86ecfe087d7f610d7dfa09810f3fb

SHA256
f0c6086771d98dc533925c66ea21a89b2deb3e1cf2abb3dee0efa8ba92a0d9b6

SHA512
ec67b67bda23f1eadc80da213fb1c6a2edd0c195f11aeb6c3a3b4b21f84c837c1efd9ab1c6bb27f1ac1dd3812ae661b13070e26389e0e3495ef1c97ba6d64070

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
27b3e2a17ced8483534ef742a9cc2a61

SHA1
87ed8b6c3212e2e582eb225e674e50d7f51b7989

SHA256
5d436172a8e7cda7d396f660faaf95e92c2bd9b1ab7bfe929062fb124f2a4e50

SHA512
c89d13aa34121058882faf68fe9ac85db5639865eaf3c0e386d140499aa55da0a8e363a7625c287403142b47c605798976071bc4dc76c86db9c890000122dd01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
901B

MD5
3bf8678ad3d65d662057f64723cee962

SHA1
4f684afcda60ab4077ec9c7c4f07a85a584b9c94

SHA256
2884c499dd50b13e50c44e3ef53491e2ac547260337c4c40aa5f0cecd92b9bac

SHA512
c3bd1d5f07880b6cfd319c21c5d03c3b956d8d96bc7ecdffeb6b8ed8ac516c56da87cd4c46cca953c7fd47dded83088a5e2288316acf2b52292fdbe31e834acd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
34f57b018ce7906f5463d85b271d77f5

SHA1
74b564863eef08640a43783772880fc9c7c2344e

SHA256
8b0d33d2c59fa4854c5b765456fa673db94d6c960a44053371cff4ab86090eb6

SHA512
3a0ac643147b1c9a27e08806285c30c60ceea560692035b763ed827373d3fe0477dc6272524acdd8b0bb269f98759c6759339f6ba04485c34f008ed6c8a61e17

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
13e354276ef29c9af01ba1174860e229

SHA1
2c3ee0459b23b7cfea4d5505b22c2dfe27c4f4f8

SHA256
d1d03b67af7f0e4263fa7f9fb21d697ae48b9817762eeb2aecaa35225afd412e

SHA512
acc56cc067426b333947dd23b2b9ac85ecfa8ef2d55f33bdcdb2338627dd1620a1b7e169aa7db535fb06d8bd138af6c1319c9aa4b9c4957b05368b45d7f8d995

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
6230d71fd8fb853faff1a76feca44058

SHA1
6fc5981fbb61090913c7c82fea988cf60821321f

SHA256
68789d73e2400729aae37ef70659903ab16c352c57648654f74d96f63b94f685

SHA512
f05a7e9c4f9ea503c6ba037fd54d274daeccaaf3bf4aaea1ab456259fc4e5b36d3063a85bd99520cadeea8aa31a3c337622057d1b6d8faf30ac4d924b9beb496

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
897B

MD5
4651fe43fd1ffffa6337f9a80d21a90d

SHA1
93a1d95739abed631c762aeb465bdc7ac2039551

SHA256
69bfbb201c9a24154c222f320cc5197860ee074c25cc465757b1e937b48473d5

SHA512
92c13b1416dbf38298c116782c9f974c0e2e32d31ba504f81d308945af1fbd19ac903d3e7790331ed399c0733f65565d8dd0b3ced262a5e5fec9e1c0eb0aa0b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
629de5ebb6d693d4841e5098ef43f6b6

SHA1
60e467a7ff9fb84dd3a9978edc78f05c0e996828

SHA256
8c1ff88bddbc46d408f7d99cf726ffeea8386b69baeae6d87d39afcd1cd371ca

SHA512
df5fe15e7c2363d0655a0bed89a4d8d8a0a14a5125bb4cacf6aad829b76206a90ccb3065efea4e660b29ddbca88afebc9b24e34a59728b584195ccb88bd28fdf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4
Filesize
891B

MD5
862ee4dcadfa5d88fc07c50ae2a7cfdb

SHA1
dfe2c4e0124d7ca988a61d51a2edc61699bfaa52

SHA256
36d6dc545d679b718132cc65879a5b4b813bf35086c7f601bef85c9d2b0e82c7

SHA512
30f4e2d453d9fcf5317189895ce476ec1a24b7118b1e080f98262a4ac5095b68847c41f74d54841cdb5d1f9a9acc7a4c97ed9f1d9ecd46b38365573c1cc9f75d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4
Filesize
890B

MD5
13df8ee83758916f026df1d2e4a51b47

SHA1
e6ab6d0c0424946c363695c697070e082de041b7

SHA256
ac677f08762314c4406b56d90a6a6c5da7830f244467f54e0d0283896dee85da

SHA512
c1a3be487e5c2f2b59ff99ec1fb784d74692e011f68d917aa7fc81e49727fbd4dc96ccf7cc8a20f8bcfb08ff8591c00af3da2eeee5b930ee4ce8388920af47d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4
Filesize
4KB

MD5
a766bcd6e62990bc466f1442a113921c

SHA1
6398116dc71726ada51b412e8e326dda4b0c47d5

SHA256
ee9bc4f792376c6d258b80b2c910503afa675b2aff36721e5987aff69f42e3be

SHA512
9ca0c0640b15a834d696ac97b45dc7d362f36397df0b2444ff186188d1d1815f25b520b58b91ee5744a5fcb4b9415b6b4ce8162608cbdf5e1815a7946cfe0bbc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4
Filesize
890B

MD5
5d46d4e4bc252d4cf1b24282d66c2588

SHA1
971bee62f2c6193785641a42179637542cb3e67d

SHA256
106944f3c32a9998067c85161977b02634fa16846456902101348cf26e53a448

SHA512
196fd67fbbe05d16d8be2e839435c64a5e97d81f33425783048b044a3faef4683bd1c16b5f410716c63a2dabdd285bfd9782c64c6ac700886fdf0593b2d76801

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4
Filesize
15KB

MD5
a555038cddca15809f5a89a72a472ec5

SHA1
280f42e26530f27a561f86175754649c4c43980b

SHA256
fdde5b4b1a1b17ab5f877463b08da2c465ad5403541631c133c01f2d35efaf64

SHA512
2d468cd74c3b28106c83b6b161a34423edacc134f231c01ca85433b71e15683f7617e24c7da4a920143d2340ed3aaaf799fb4c80c2f0f61726e986868685adfa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\xulstore.json
Filesize
140B

MD5
2f77a22a0ad9dd475f6472ee80e24502

SHA1
d82f81847b59795dcfc7d598cd21ede56f770df4

SHA256
babe9aa73effd73d7004d21d41433674cd426a4dc57544ee2d2a87c345bda8f0

SHA512
eec181b3ccfb198213653651c765012b5e7803dbd95d0bc49a61e53bdf05b101b2e0694a77277698c4e05058525146d121fdb862a3ffcfdb180cbc6c71edca41

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\xulstore.json.tmp
Filesize
216B

MD5
6fc65aae4285f1db4767dd8184b520c3

SHA1
3db85e2855fcf3b1f04e2527f311db0b0b041e3a

SHA256
86f6f9f35152b3f69c947856790e8b2bf8fdd6e1ff6397d2494129bd7a8feee5

SHA512
addfd9bbab1892b707a27f608934abbdd050733c38a9601eb7f172f11742ede2407a687a7e47b55137dd460ba1d2354901a5faf131447259a0febc5d0df6e464

Download Submit
C:\Users\Admin\Desktop\@[email protected]
Filesize
933B

MD5
7e6b6da7c61fcb66f3f30166871def5b

SHA1
00f699cf9bbc0308f6e101283eca15a7c566d4f9

SHA256
4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

SHA512
e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

Download Submit
C:\Users\Admin\Desktop\AssertExport.ppt
Filesize
218KB

MD5
9e7c8f15698904360aa06d4a2ef92007

SHA1
aa63117806af647607fd62ed9a1e5b6c2d588f2d

SHA256
d30d2a6bf65fe98a10d80be0750b7a6b1f99682ec6b6b9ecf5ff0ccefea42592

SHA512
bda8d96d65339e25e86286eefd1b2182388e75d4e095310efd0f2f9d4267c318b355f8440366b66d44282bf7eccc54f98312a98b20c4703e2b4ea935b784f7d8

Download Submit
C:\Users\Admin\Desktop\AssertOut.au3
Filesize
290KB

MD5
4b048833695e34864d3f94e71958056e

SHA1
56b10aed09a394fa0fdf350ebb76a185e56d9879

SHA256
fb0fe363e2c006f15e9f5fe3bf2a6262cb73f3910a5ec5159956fff8d1cb0582

SHA512
ba3c30f0517c9ecdbdb333f94179ce31f2bc3e24a2f030a87e38b1d0bf51fd67814e70221bb7cc5555e20a4dfcc6f71553bdfb393d0c09682bc8f9176de89582

Download Submit
C:\Users\Admin\Desktop\CompareRemove.pps
Filesize
299KB

MD5
191148406e1f57e1b45329628e92e924

SHA1
d515d6a8e3fd4958967912769b8883cdc3a589d7

SHA256
93a91222fece13d12b4e960fb8b1aae6a8c1ab09df5133fb7321952a533f6dda

SHA512
cf8324a3b91f58dcc7ed607e2d4681c884cff5f9617b8f3dd6744034b99e43883a4e15d8801b4f98df7eaf48a00b05fe238c7a8093e485ee4a05fca6085af72c

Download Submit
C:\Users\Admin\Desktop\ConvertToImport.sys
Filesize
263KB

MD5
e8bbe24792a8b29051f72acb8f1bd6ba

SHA1
e6e59ae4c2e525f1a33e4a5688c06ad99415a959

SHA256
8a4873fffb57ac4791badf24622096c0f9e64cb5d276bfa30ef50e40f11c27df

SHA512
e2d4aba072d11376969face9b15a6838a9dcc29c77e86d8a95e67c77b8bb2d16a6b89e6a01f60436200b02d538fc5aec45e83dfff7b8a6155cd61081a9403e65

Download Submit
C:\Users\Admin\Desktop\DenyGrant.tiff
Filesize
463KB

MD5
a9582184267f0f2ba51c55a5d5154782

SHA1
d109a3d3ac0da5b591ab024a6ef8477957d86abe

SHA256
32d9a813c590dae527e5389503496dae14598d8111a120457c3e3d8b6483dc67

SHA512
ebd7ff1722208395ceb45d49986eec311db70f11163cc9946fbff428a2d5959cf47fb68b21c5fd85c541a0d2c34603d00d37a11e1c28ce466035104a19b3d041

Download Submit
C:\Users\Admin\Desktop\DisableMove.css
Filesize
145KB

MD5
2c2b5de42df22df107e391252d3b5249

SHA1
f0fbb4f8877ff2ba55b780beb9afdf2b1e65c76f

SHA256
b780465f047c24cb9092602f4f6f8e843347b3f6ba41188d0a23a6647ccb97bc

SHA512
c2238a6a1e267ffca112eb9fbf30b25530f3ffdd9f47f35eba9cdab1aba7193392bb1de986ff9d2e6e3f3a1c1a6151369850d7e53078ff1989baaee91dbe82c7

Download Submit
C:\Users\Admin\Desktop\DisableTest.asf
Filesize
254KB

MD5
b650ba84489d72c7245310e52a7ffa3c

SHA1
b980cd01c0c497a987f69fd712aa062ac155a9c7

SHA256
4bee9b0c5f885660d5ce7b560f800f99421f040b8ee5852930cf8ba319f02e79

SHA512
9b745acb0f91e4cc82cdb05ba5bd515100917637f024872474191101a8f604a85d968f89d15afd897995fc097e79a112220863acd6a4e01ecea908bd4de2f0a5

Download Submit
C:\Users\Admin\Desktop\DismountBlock.xltx
Filesize
181KB

MD5
0bce1d9f183a2f91c83ca58108612df2

SHA1
01175d1ed7c770d31f373f97c6d19460ec736048

SHA256
984b77cd4afc155cad3416f9f9ca128b01165be93e08fbb1ba2277a008195d9e

SHA512
db5369e3b040cf2fa47c8d697551c0870726336126eb5f057c855ac7d750aa8a7219ddf0218a012bf7383b441ccdbfd939d54fcb8ff341d5f61b142b18a6a902

Download Submit
C:\Users\Admin\Desktop\DismountClear.vsdm
Filesize
227KB

MD5
1b36582924d36002e7d6ac511b296d71

SHA1
6dcb7e221bbfd8fee24dd0de723749616425f913

SHA256
6be5fb167c0a33ed715995e3a852090dc545f2a75d35828912c0984c4824093b

SHA512
ef30753d335bc67943869ac1c8f096e3248469ab021052097d94e15e69dd0e6daff26d0106a292a8eae7c90309f830187d2f0dfb3fd29c41c6fa0c5e65d0ac54

Download Submit
C:\Users\Admin\Desktop\EditOptimize.midi
Filesize
127KB

MD5
25ac475ac1da978702590924d8f0c9cf

SHA1
e41bae45f617d42f282181673344f0c30a91e230

SHA256
07f8ccea5903e0cbc03402ccfc9f89092a0b0909ca9dccc48abb4060348514f3

SHA512
118cc244f9edf3e0cc06bcb06fd82fe27587be5fa6a254a505f0956821a8f60d4b321195a6d6c8be308f88e445e8f92c47ca8d5d1f7460d96e487651c279ecf9

Download Submit
C:\Users\Admin\Desktop\FindSubmit.docx
Filesize
118KB

MD5
0dede3b76f25dae8bedabdbcc62389a5

SHA1
923616102a53439c1586103f59e3e8fdd51f2d24

SHA256
516758168eaedbab3aa95b24704ebf237bac6c7439899914de559eb80537ccea

SHA512
4d0a4ddc2d20d65a1b2bc43656dcdedda13b731859d79805f7e2d6ff8e4c798e4b5e297f8cd0757c596336b0d143f479862a32ca05291fc120b7db9213461ab2

Download Submit
C:\Users\Admin\Desktop\LimitRequest.vsdx
Filesize
318KB

MD5
5f81ea663f6342c3b05160e8f4012584

SHA1
ac9aa6e3df73769d402998f3026edbf8a322585c

SHA256
cbc6c3a0343942c47406878851d5c86825e18e208aa9a0da9ee09fb8f9d7280f

SHA512
27647f36c991ab8f445d7ba90422484393f2a8c3de6de193eee92e8fb3190c96e62c301b2732964cf3767dd4a98606ec5db0899e82e1579855d93a4bda2436f8

Download Submit
C:\Users\Admin\Desktop\MountRestore.sys
Filesize
236KB

MD5
cc443d25767f6e14d3b40c4eb83cd146

SHA1
25d5aad5cbfa10c99b0818ba246d6d071001ce18

SHA256
875e0f2293641a5bed3dd7a24a7f08046309ee84eccbebeeef0a7fa7b99f1046

SHA512
caca1d18dd2c6bdd67839fd0fe8db7e480e8349ac5f19be79e9284407cd6cbde723f13fa0df2c8b4d1b0591c8cb472d9907a05ea03a41e3877f609a3d6938c99

Download Submit
C:\Users\Admin\Desktop\RegisterTrace.clr
Filesize
163KB

MD5
2cc48248b152480987bae14c2bc5db66

SHA1
84cfc315817d7968974d91f34a96fb4be07cbc92

SHA256
0bbf79c5a7270a8b3777bc6e440ee073ac8399b46466781a708c1b0deac5f66f

SHA512
a8ebeded6245bd88259d68d4a0f50917f9ac84eb77f84a2e54613a7695c93912899d11d9b35f38ea710a698b65288e48b2d5dd7e650b82588660006d59d7a4ca

Download Submit
C:\Users\Admin\Desktop\RemoveInstall.vdw
Filesize
199KB

MD5
baac129ad51b14c50dd3b9eee30eadd1

SHA1
2e6d264f3691a47eb556d164aa6ee6f7c158869b

SHA256
35de81533a512b5b367188d2ece068874a400de65cca5f6838cf962daeb055de

SHA512
8770b0d013f9d15222b1cc5baf3661bd92e35e82b4604d71a9314d6972de1f7a3f470a6074fff476f63f914af4b8c2dcc704a065d3a45d7ac9ec7dfb2ea4d120

Download Submit
C:\Users\Admin\Desktop\RenameExit.mp3
Filesize
281KB

MD5
59eaf5976095716c8bdfc7e76688faad

SHA1
70ab1827aed3209a9c29eec0897ec7cc7598a593

SHA256
81803c646be05effc0ed41c0fb8f4f7af424462bfd5233fbaaf8c8a8df13016a

SHA512
8263c9dc22eae23ca15154a5c486255efcaa30080547f64d7ecf68b2b31de3051f2f8d4342f4e4d3466162d4c9cefc87331dabfe1eebf39b890399bdb9463993

Download Submit
C:\Users\Admin\Desktop\RepairResume.m3u
Filesize
136KB

MD5
046f9277a3a5c814366931758be9e5f2

SHA1
a48f735322a63e680ce872f1980fcb5e2a1fa011

SHA256
5dd27c6bb6639f14e7002c734ee7e62db7f5f76a00c07e4e189f04a7ec9e27cc

SHA512
6de8f3104aafcee23651da6efe75354666c421c191e734aef9319b5a0d7b2f98e73917357ee1355d9704076b03d0989ef81ac061f6d055284f87168e66086fd7

Download Submit
C:\Users\Admin\Desktop\RequestReceive.otf
Filesize
190KB

MD5
cc95303db41393db514c8eb80660aa09

SHA1
3c3fe996c2c2ce3f641462d104d83fb33fedcfcc

SHA256
bf0b58ea1ce7593ef8150b9b8470bb890945097bdc02498289c1352725ac1b84

SHA512
4b50cfbdf245ad7965d73dbbea8f86dffe8dd90cc87f4fc6cd1698401d9cfb813e46750666abc458b836af9d1df26e15944c9562d84d2cdb26301793e3ac0a26

Download Submit
C:\Users\Admin\Desktop\ResizeUnblock.css
Filesize
209KB

MD5
30b2c69f4c04c718258979816dd30d3c

SHA1
11d206fbde35f10f5329934db8263a9a13f98914

SHA256
b9635ae072a055f361765865370ab941ce1ab51c1c0962074984f4e10a8e01a8

SHA512
22779c0d2061b80d012b58ecf4a6577dddd99f6abeb754f45231aa39d4274947fef88201793d7bf6cefd7cf727106898570169939b4ee0dce61ae9bdbbec0684

Download Submit
C:\Users\Admin\Desktop\SkipSync.xlt
Filesize
245KB

MD5
c22a76d5957005ae14cfde951fc1aafc

SHA1
eeae6e736ce65e9267251db57dade46ae7ef7085

SHA256
fea05a09eb33ea9d62a20c78a89f7b6b61f73d45fa3655b8c55b609d344a1d92

SHA512
041e64aadc559801d5238cfc199630cb553f2882167c5667fc4c6755eb3c29d756359ee688566122dfaeb24e4178027073494a2436894237683ff74bc7ac9caf

Download Submit
C:\Users\Admin\Desktop\StartRevoke.WTV
Filesize
154KB

MD5
670e0328dfb1f547ca8a4039ef99705c

SHA1
bd6ecb26f39d30ac9d5fc968ef8412325f300e34

SHA256
194c3a1bd977fa4f12169a64044102fc9b1ff8853ec285cd8e9f9633c5a46085

SHA512
bb301febc5bdefcc7e2330793acbd2d8f32e27f39b0369ed346ac56c64032965f1d2f127ce02127acd61ea764e4bda7709ccccddfc3aa0fb64195460f3dde556

Download Submit
C:\Users\Admin\Desktop\UnblockResume.ini
Filesize
309KB

MD5
85204ae4bd4f61a34f8b4de9d52a8987

SHA1
61a3e61b1e02305d988d15b1e4cbe39de04c47f0

SHA256
89d5914b9daa891b17704de63f23cba340458b997aa7eac850f75c995aec4860

SHA512
cde5f39ae9c0e2eb0ad0685be91acb2167e622c2e5c32598955585b12357ee2a7a3581f6437c724c8aa756bdac1fe0678a10b6f421ce43d892b465d932bec143

Download Submit
C:\Users\Admin\Desktop\UninstallResolve.ico
Filesize
172KB

MD5
9ee9ae13468712c26a26881e3bfd25f9

SHA1
af443514aeaea761af4175206c5ada67a70d7c83

SHA256
c80a4d348aefe89801ca1a624053bde2e1f9b4075a85ca0a2170a02874bc5d12

SHA512
4f2b3b8846c1580bb7214d2f31ef5de9092c65fc1a90c665a82462161676a78a0ffe83ae9336d3077dd2656235c285a0156505f3485cd364a25440005f720f11

Download Submit
C:\Users\Admin\Desktop\UninstallRestart.aiff
Filesize
327KB

MD5
4e1aadf9eeffe4c6e4a597b089269176

SHA1
e5788c73b4834f98d3594fc866a900f7fd134a69

SHA256
9fb849f1622eca7aee67938aee0de6a076d1e0c3d79aee9b271eabdf833dd615

SHA512
d943a571cd093707dabb844669d788f91970cfdde5a39bc222146ebf588b3872bd27189f863952289c158e70b7674079ced95e7feeb56024c85b2cbe2a95cd00

Download Submit
C:\Users\Admin\Desktop\UnpublishUpdate.wmx
Filesize
272KB

MD5
efa5aa6ed3a04e2968e21b38440d5eaa

SHA1
f858149e66b474d87abc11c1a7a4995f87cdc0cc

SHA256
c35b390ec96818ce4bd5ca0ca9a6bd6935bd7f482c051681ea9f6966acd35108

SHA512
1adaa283bd2132055a3f9dcf9545ef2b2c4eda75c1cc632eadcb069f5f19006445c237258241c548e4223a835a1749f2b47781d8f9881fedc40cd1dc9036e4ac

Download Submit
C:\Users\Admin\Desktop\WatchSwitch.odt
Filesize
336KB

MD5
299661a2ed0555a4f52b0f60215cae21

SHA1
982a2a8bc741cf9cdcad1c39fc07e8975ab84314

SHA256
42ed9df470a178630dfc9dad309fecc1b8e18cc13ade8948c96a7d1c8f53bcd1

SHA512
ab130ca43142b30612d81275641cb040ee6a85fbbd7585e939f099a1b2313ec4067bab45a4f6c543e16dc91d315a003f9a49046457a41d02e03c846da6351640

Download Submit
C:\Users\Admin\Desktop\msg\m_filipino.wnry
Filesize
36KB

MD5
08b9e69b57e4c9b966664f8e1c27ab09

SHA1
2da1025bbbfb3cd308070765fc0893a48e5a85fa

SHA256
d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

SHA512
966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

Download Submit
C:\Users\Admin\Desktop\msg\m_finnish.wnry
Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Documents\@[email protected]
Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\7k8U-r0O.zip.part
Filesize
7KB

MD5
bcdc8075a2bd0c7a10be7c9fd9e41361

SHA1
89458b91cf3341f669ff04500de5ea469559f40b

SHA256
5e706327c378b2f6e94b638b597b60061c70be4b33a0364178c1065e5445c3b3

SHA512
f7ead60932f839f690e94609ef9bfbaaae8a921ac3c092be2e8349c283a5eaf9dc8ab7eb7dd27873d56ac8ad4214a9a5436ca78953fa557e1a7eff4597a181c8

Download Submit
C:\Users\Admin\Downloads\RANSOMWARE-WANNACRY-2.0-master.zip.crdownload
Filesize
3.3MB

MD5
017f199a7a5f1e090e10bbd3e9c885ca

SHA1
4e545b77d1be2445b2f0163ab2d6f2f01ec4ca05

SHA256
761e037ee186880d5f7d1f112b839818056f160a9ba60c7fb8d23d926ac0621f

SHA512
76215a26588204247027dcfdab4ea583443b2b2873ff92ad7dd5e9a9037c77d20ab4e471b8dd83e642d8481f53dbc0f83f993548dc7d151dead48dc29c1fdc22

Download Submit
C:\Users\Admin\Downloads\a29dbe9e-2fef-4260-9c9e-a7f118b696e8.tmp
Filesize
24KB

MD5
4e501017c2a9a96c38bf0c97a8df7b80

SHA1
7bba788ae8dbe13ec907db3afe8768f85a0b0aaf

SHA256
ca38172136ce2b4923c33546f9fd3ff7e5c84d5c83737ab20243fb1a0217f9fa

SHA512
b6406620660014c4c36553a280297e56dc31b7e5c004f85587757bcd9b87d82a73a5f62fe3b067ab84b44b0da2e7e1e7a58fd7b9539b78a1a9cfcc594a9fb6d1

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk
Filesize
2KB

MD5
b5c6f9f25ffc78d031287735623c39c3

SHA1
c724b5a92d7647be47f3ee4ccf21c51b84b45a43

SHA256
acf73b2d3fb34beeef3ae0e0d5b88e0f159a77e188a6584eb60c1596f43a0d99

SHA512
f52484b858b5841a86e662005257b1452935068390153925ef8f719b1b5322afa56d5b6ecf066012ff3a35ad00fe04db89e544fa1256deed60cef489d6bdd0ed

Download Submit
C:\Users\Public\Desktop\Firefox.lnk
Filesize
1000B

MD5
3d0a7fb24085093ae0b8650fd0e9daa4

SHA1
361c9ab865d131cf73b15df9532de3ff59f1d2cc

SHA256
67d1a7891f7a191669103ce6a699bcf2f3af24a5697933764afdca2c1755554b

SHA512
20a299cf876a9784d157d18df70bf0b4ecea529e8c74e6bb1621e2589e99582b09920869f7d2b1fde0ba15800cb4a2dff13a9bed64886404866cc9bebbe77286

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
c915439f2198feb98a6eb7ceb3f7d9f9

SHA1
3f2011f8ec51c48c81d9415844c9a8987f916e79

SHA256
8703ff9c0721235e77a94e1929bb33e1bbd619c3ee1269fbf5ec7b38b41a41ba

SHA512
40ae1fc6827e9d94a0de4a648566a69ad587e8fb39fdff634ef98dd0cbef8eab3fb0689f12d9f920d3b53aa25092c47b426f1661747262ee3792d208c71dd683

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk
Filesize
923B

MD5
0667a27d5d22cc3abd646432c6ea3024

SHA1
e4f34319ecd1f296e622f477a33fe6f1873af56e

SHA256
555b2726e4721495a486a39dc9968b2ec03b26ebc713421bbdbb39b7a918df9a

SHA512
55e5c5c27c0013a043b7d7265633efd036097a2b3adb2e798068cedbb141377f6034643c3df5b9a2459e8b7790cdaf64f59a11bff7d30113c7f0f4771ed1bf40

Download Submit
\??\pipe\crashpad_2868_WAUZQZQQVOLEPERZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\X360CE\Temp\ViGEmClient.dll.84A31178\ViGEmClient.dll
Filesize
29KB

MD5
a8781afcba77ccb180939fdbd5767168

SHA1
3cb4fe39072f12309910dbe91ce44d16163d64d5

SHA256
02b50cbe797600959f43148991924d93407f04776e879bce7b979f30dd536ba9

SHA512
8184e22bb4adfcb40d0e0108d2b97c834cba8ab1e60fee5fd23332348298a0b971bd1d15991d8d02a1bc1cc504b2d34729ed1b8fea2c6adb57e36c33ac9559e9

Download Submit
memory/1016-3503-0x0000000000440000-0x00000000004EE000-memory.dmp

Filesize
696KB

Download
memory/1604-27-0x000002292EB60000-0x000002292EBAA000-memory.dmp

Filesize
296KB

Download
memory/1604-1-0x000002290FBC0000-0x0000022910A82000-memory.dmp

Filesize
14.8MB

Download
memory/1604-2-0x000002292B040000-0x000002292B1D2000-memory.dmp

Filesize
1.6MB

Download
memory/1604-3-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-3615-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-4-0x000002292B6B0000-0x000002292BA8A000-memory.dmp

Filesize
3.9MB

Download
memory/1604-230-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-191-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-121-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-106-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-105-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-104-0x00007FFDE04A3000-0x00007FFDE04A4000-memory.dmp

Filesize
4KB

Download
memory/1604-51-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-47-0x000002292C130000-0x000002292C138000-memory.dmp

Filesize
32KB

Download
memory/1604-31-0x000002292C0C0000-0x000002292C0E2000-memory.dmp

Filesize
136KB

Download
memory/1604-26-0x000002292DC60000-0x000002292DC8C000-memory.dmp

Filesize
176KB

Download
memory/1604-0-0x00007FFDE04A3000-0x00007FFDE04A4000-memory.dmp

Filesize
4KB

Download
memory/1604-25-0x000002292DC90000-0x000002292DCAC000-memory.dmp

Filesize
112KB

Download
memory/1604-24-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-12-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-9-0x000002292DE60000-0x000002292DE80000-memory.dmp

Filesize
128KB

Download
memory/1604-8-0x00007FFDE04A0000-0x00007FFDE0E8C000-memory.dmp

Filesize
9.9MB

Download
memory/1604-6-0x000002292C5F0000-0x000002292C63A000-memory.dmp

Filesize
296KB

Download
memory/4448-4004-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3994-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4022-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4023-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4019-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4020-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4021-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4012-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4013-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4010-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4011-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4008-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4009-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4007-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4006-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4005-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4017-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4003-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3995-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3996-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3997-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3998-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3999-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4000-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4001-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4002-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3990-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4018-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3992-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3991-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-3929-0x00000191EBB00000-0x00000191EBC00000-memory.dmp

Filesize
1024KB

Download
memory/4448-3778-0x00000191EB8E0000-0x00000191EB900000-memory.dmp

Filesize
128KB

Download
memory/4448-3564-0x00000191DA960000-0x00000191DA980000-memory.dmp

Filesize
128KB

Download
memory/4448-3543-0x00000191DA7E0000-0x00000191DA800000-memory.dmp

Filesize
128KB

Download
memory/4448-3535-0x00000191D9F30000-0x00000191DA030000-memory.dmp

Filesize
1024KB

Download
memory/4448-4027-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4028-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4024-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4025-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4016-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4026-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4038-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4037-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4039-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4036-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4035-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4034-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4033-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4032-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4031-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4448-4030-0x00000191ED150000-0x00000191ED170000-memory.dmp

Filesize
128KB

Download
memory/4448-4029-0x00000189D91D0000-0x00000189D91E0000-memory.dmp

Filesize
64KB

Download
memory/4484-5411-0x0000023A6D860000-0x0000023A6D8D6000-memory.dmp

Filesize
472KB

Download
memory/4484-5400-0x0000023A6D540000-0x0000023A6D57C000-memory.dmp

Filesize
240KB

Download
memory/5344-2218-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download