growtopia | 5a52085a5f8f591347e11bc4c9246887ebe5dcde0209edc7016e3d6000f1defa

Resubmissions

06-02-2024 13:38

240206-qxtv7sgcc7 10

06-02-2024 13:35

240206-qv2g9sgbg2 3

Analysis

max time kernel
255s
max time network
280s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlitzWare_Fortnite_Menu/BlitzWare.exe
Size

12.8MB
MD5

3b4a760c064fa2e6f5b05c9da03333c6
SHA1

8053af5d5858430a3b6f28ad3c8c5be47932dd5d
SHA256

bc2d16deb9222945b10f9511c777d7125042d31d748a0f42affc8a659f2dac79
SHA512

54399f1198a15e52d04d0d8a0f59ccfeec067ccf331393a1311bb81b6f034449c42ec02fe3811f827847b93916a2264408035c49946e598368bb9a9278cdba0a
SSDEEP

196608:Ob5hSxqJAcXCMEKngteZX07mvbSHL8D++wsmReLZijeBCMcwJADXbsdMN2LId+3B:Obmq7yMERtD2bysmMijstOX422cdK

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3664-57-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-59-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-66-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-83-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-63-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-99-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-132-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-135-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-138-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-143-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-147-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-149-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-145-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-153-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-151-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-159-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-161-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-165-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-171-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-173-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-175-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-177-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-181-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-183-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-186-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-179-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-169-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-167-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-163-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-155-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-120-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-115-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-89-0x0000000005100000-0x0000000005165000-memory.dmp	family_zgrat_v1
behavioral2/memory/3664-43-0x0000000005100000-0x000000000516C000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BlitzWare.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	BlitzWare.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exesc.exesc.exeKeyGeneratorI.exeConhost.exeWinErrorMgr.exeKeyGeneratorI.exebauwrdgwodhv.exe

pid process

3664 Ilkdt.exe
2916 sc.exe
4752 sc.exe
3796 KeyGeneratorI.exe
4412 Conhost.exe
3608 WinErrorMgr.exe
4432 KeyGeneratorI.exe
964 bauwrdgwodhv.exe
Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorI.exe

pid process

4432 KeyGeneratorI.exe
4432 KeyGeneratorI.exe
4432 KeyGeneratorI.exe
4432 KeyGeneratorI.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

35 discord.com
36 discord.com
108 pastebin.com
109 pastebin.com
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

228 api.ipify.org
341 api.ipify.org
469 api.ipify.org
585 api.ipify.org
588 api.ipify.org
590 api.ipify.org

pid	process
3664	Ilkdt.exe
2916	sc.exe
4752	sc.exe
3796	KeyGeneratorI.exe
4412	Conhost.exe
3608	WinErrorMgr.exe
4432	KeyGeneratorI.exe
964	bauwrdgwodhv.exe

pid	process
4432	KeyGeneratorI.exe
4432	KeyGeneratorI.exe
4432	KeyGeneratorI.exe
4432	KeyGeneratorI.exe

flow	ioc
35	discord.com
36	discord.com
108	pastebin.com
109	pastebin.com

flow	ioc
228	api.ipify.org
341	api.ipify.org
469	api.ipify.org
585	api.ipify.org
588	api.ipify.org
590	api.ipify.org

Drops file in System32 directory 4 IoCs

Processes:

sc.exepowershell.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	sc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 964 set thread context of 3336	964	bauwrdgwodhv.exe	conhost.exe
PID 964 set thread context of 4036	964	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
4652	sc.exe
4752	sc.exe
1292	sc.exe
4060	sc.exe
5048	sc.exe
2916	sc.exe
4616	sc.exe
1768	sc.exe
4640	sc.exe
4908	sc.exe
2136	sc.exe
5052	sc.exe
376	sc.exe
4868	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1332 schtasks.exe

pid	process
1332	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 2 IoCs

Processes:

msedge.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{DB1CA4B9-9369-45CD-A76A-A6922F5971C4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Conhost.exepowershell.exemsedge.exemsedge.exeidentity_helper.exesc.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	process
4412	Conhost.exe
4412	Conhost.exe
2848	powershell.exe
2848	powershell.exe
1196	msedge.exe
1196	msedge.exe
2924	msedge.exe
2924	msedge.exe
1256	identity_helper.exe
1256	identity_helper.exe
2916	sc.exe
4296
4296
4296
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
2916	sc.exe
964	bauwrdgwodhv.exe
2084	powershell.exe
2084	powershell.exe
2084	powershell.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
964	bauwrdgwodhv.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe
4036	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

Processes:

msedge.exe

pid	process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

Ilkdt.exeConhost.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	3664	Ilkdt.exe
Token: SeDebugPrivilege	4412	Conhost.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	4296
Token: SeShutdownPrivilege	1604	powercfg.exe
Token: SeCreatePagefilePrivilege	1604	powercfg.exe
Token: SeShutdownPrivilege	4760	powercfg.exe
Token: SeCreatePagefilePrivilege	4760	powercfg.exe
Token: SeShutdownPrivilege	3604	powercfg.exe
Token: SeCreatePagefilePrivilege	3604	powercfg.exe
Token: SeShutdownPrivilege	4784	powercfg.exe
Token: SeCreatePagefilePrivilege	4784	powercfg.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeShutdownPrivilege	2444	powercfg.exe
Token: SeCreatePagefilePrivilege	2444	powercfg.exe
Token: SeShutdownPrivilege	2216	powercfg.exe
Token: SeCreatePagefilePrivilege	2216	powercfg.exe
Token: SeShutdownPrivilege	4856	powercfg.exe
Token: SeCreatePagefilePrivilege	4856	powercfg.exe
Token: SeShutdownPrivilege	3004	powercfg.exe
Token: SeCreatePagefilePrivilege	3004	powercfg.exe
Token: SeLockMemoryPrivilege	4036	explorer.exe
Token: SeDebugPrivilege	2536	firefox.exe
Token: SeDebugPrivilege	2536	firefox.exe

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

msedge.exefirefox.exe

pid	process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exefirefox.exe

pid	process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

firefox.exe

pid process

2536 firefox.exe
2536 firefox.exe
2536 firefox.exe
2536 firefox.exe
2536 firefox.exe
2536 firefox.exe
2536 firefox.exe

pid	process
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe
2536	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BlitzWare.exesc.exeKeyGeneratorI.exeKeyGeneratorI.exemsedge.exe

description	pid	process	target process
PID 2952 wrote to memory of 2848	2952	BlitzWare.exe	powershell.exe
PID 2952 wrote to memory of 2848	2952	BlitzWare.exe	powershell.exe
PID 2952 wrote to memory of 2848	2952	BlitzWare.exe	powershell.exe
PID 2952 wrote to memory of 3664	2952	BlitzWare.exe	Ilkdt.exe
PID 2952 wrote to memory of 3664	2952	BlitzWare.exe	Ilkdt.exe
PID 2952 wrote to memory of 3664	2952	BlitzWare.exe	Ilkdt.exe
PID 2952 wrote to memory of 2916	2952	BlitzWare.exe	sc.exe
PID 2952 wrote to memory of 2916	2952	BlitzWare.exe	sc.exe
PID 2952 wrote to memory of 4752	2952	BlitzWare.exe	sc.exe
PID 2952 wrote to memory of 4752	2952	BlitzWare.exe	sc.exe
PID 2952 wrote to memory of 4752	2952	BlitzWare.exe	sc.exe
PID 2952 wrote to memory of 3796	2952	BlitzWare.exe	KeyGeneratorI.exe
PID 2952 wrote to memory of 3796	2952	BlitzWare.exe	KeyGeneratorI.exe
PID 2952 wrote to memory of 4412	2952	BlitzWare.exe	Conhost.exe
PID 2952 wrote to memory of 4412	2952	BlitzWare.exe	Conhost.exe
PID 4752 wrote to memory of 3608	4752	sc.exe	WinErrorMgr.exe
PID 4752 wrote to memory of 3608	4752	sc.exe	WinErrorMgr.exe
PID 4752 wrote to memory of 3608	4752	sc.exe	WinErrorMgr.exe
PID 3796 wrote to memory of 4432	3796	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 3796 wrote to memory of 4432	3796	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 4432 wrote to memory of 2924	4432	KeyGeneratorI.exe	msedge.exe
PID 4432 wrote to memory of 2924	4432	KeyGeneratorI.exe	msedge.exe
PID 2924 wrote to memory of 4064	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 4064	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe
PID 2924 wrote to memory of 3000	2924	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BlitzWare_Fortnite_Menu\BlitzWare.exe
"C:\Users\Admin\AppData\Local\Temp\BlitzWare_Fortnite_Menu\BlitzWare.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAbABpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAdwB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAaQBjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  PID:2916
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:4296
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4652
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Executes dropped EXE
    - Launches sc.exe
    - Suspicious use of WriteProcessMemory
    PID:4752
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4640
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4908
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2136
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  PID:4752
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:3608
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5EB.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1332
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4432
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb60dc46f8,0x7ffb60dc4708,0x7ffb60dc4718
1⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4780
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3320 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6220 /prefetch:2
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1548 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2416 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,8449219048768675803,15465661064447895328,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1548 /prefetch:8
  2⤵
  PID:6136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:964
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5052
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3336
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:376
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1292
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Launches sc.exe
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:4060
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:5048
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4868
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1216
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Checks computer location settings
  PID:4780

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2728

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:940

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:32

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6080
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.0.388707786\834294680" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {105376f9-8b31-4c41-94e1-7d4462a6f653} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 1964 25031eb6958 gpu
    3⤵
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.1.2128768005\1888627622" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8949a426-206a-497a-9c78-7958bffc34d0} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 2364 2501e070d58 socket
    3⤵
    PID:3956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.2.1097667868\1419896197" -childID 1 -isForBrowser -prefsHandle 3144 -prefMapHandle 3140 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baa9e190-8e59-4952-a1ff-7f0d4cbe78c3} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 3152 25035db4058 tab
    3⤵
    PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.3.553278878\1684658401" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3592 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa6f1b0e-6bec-4d84-93d5-cf5f354ac67b} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 3612 2501e061358 tab
    3⤵
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.4.1693860956\1341985390" -childID 3 -isForBrowser -prefsHandle 4452 -prefMapHandle 4460 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ab45fc3-05b3-444d-b467-716e235816b5} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 4440 25037afae58 tab
    3⤵
    PID:4696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.7.414592562\985047322" -childID 6 -isForBrowser -prefsHandle 5664 -prefMapHandle 5668 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57b6b9ac-a5f8-4ff3-9291-796e4f72d594} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 5656 250385a9d58 tab
    3⤵
    PID:4952
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.6.1771791299\410471682" -childID 5 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e55fa605-dbc9-4696-968a-cb6e1685883b} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 5528 250380b4c58 tab
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.5.113524578\2105733259" -childID 4 -isForBrowser -prefsHandle 5296 -prefMapHandle 5292 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2693dd45-93f8-4e09-ae86-4be8ebca2590} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 5308 250380b2858 tab
    3⤵
    PID:5788
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.10.881258568\1607785379" -childID 9 -isForBrowser -prefsHandle 5160 -prefMapHandle 4356 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0644a19d-7315-448a-88d6-5c69290ee39d} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 2968 25035d1a958 tab
    3⤵
    PID:5404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.9.874280212\1569456175" -childID 8 -isForBrowser -prefsHandle 2816 -prefMapHandle 2812 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1754c5ea-6d71-4e86-a88b-cd50e2a0ca3b} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 2960 25031dfae58 tab
    3⤵
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.11.938898502\852655329" -childID 10 -isForBrowser -prefsHandle 2636 -prefMapHandle 2632 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80777b3e-a56f-4f9a-9012-49cf34ca09f1} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 2644 250390d7258 tab
    3⤵
    PID:6088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.12.2050825043\1187937638" -parentBuildID 20221007134813 -prefsHandle 1964 -prefMapHandle 2988 -prefsLen 26285 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b7fb016-a573-4c80-98cb-a446f36311e9} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 5836 25031830b58 gpu
    3⤵
    PID:5888
- - C:\Program Files\Mozilla Firefox\minidump-analyzer.exe
    "C:\Program Files\Mozilla Firefox\minidump-analyzer.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9a5fd812-8484-4af2-ae64-e6c18a69cb3c.dmp"
    3⤵
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2536.13.743125437\235158257" -childID 11 -isForBrowser -prefsHandle 2788 -prefMapHandle 1480 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cdf4703-028b-4217-812a-762b86b7fa4e} 2536 "\\.\pipe\gecko-crash-server-pipe.2536" 5848 25032d0c758 tab
    3⤵
    PID:5580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
228KB

MD5
54d3efc62ff9cf4e1403facd7a80a53e

SHA1
35509450d90626795ecb4db2fde611bd744a6f22

SHA256
a57e18fbf95890f71791ab3be45432c477a189c0bd3100d21b6fb5dd47782714

SHA512
2f9908674f4638bc9482059fc67bad81ecdcb4bfc3ee14648e40277ee31690558817df332c431d2812377b4b4cde67be67c25b6790b4f17e14f855d209a8d8a1

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
377KB

MD5
f373e0c4bed7ad513f21e028a616d928

SHA1
03f80c5df6b3caf4aa268b476a227767ec6ab981

SHA256
34444136fefb43b7493b3146a0955d06bb8a3708b63eac97c7fe98fcbed3f16e

SHA512
f8a12eb11873b98ce808d1a18578ecc8d13295844fbaad8080c1bf36bb6333460e8fa7ceabf1572d16ec5b072ad772e5170593aa7bba550fba56be22e19ae00c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f246cc2c0e84109806d24fcf52bd0672

SHA1
8725d2b2477efe4f66c60e0f2028bf79d8b88e4e

SHA256
0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5

SHA512
dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
21KB

MD5
44129a82842153ef9b965abfb506612a

SHA1
c0964eb2ee1a76d48e4e09e31915415d74e18bbc

SHA256
8a3908fb32a414703eff3e435566b1e5598eb3a5d50c500e70eb1a5c20d003d7

SHA512
77d149f19343d765834f2bcaa02bc160c75bd42db1fc431aba87f78257a83c4c8a7e5953c247cb7cbbaf4ae44ace269eb0a5194dfd7489d66f69489ce5dd78d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
599KB

MD5
d2b64ae4848bffc12a95fbdba86a431b

SHA1
3b76a611b8f61f289b780019bab7bbab2c774101

SHA256
a7f8f5b0a6745b4243ed4b5a67e671eed3614cd97ecd46b7f76507b268a31f30

SHA512
e71cf143bba9feb33bdd0097b2728af65af069e7b8856eb6750f2db281726d66d82b71bcf35ee3a62ad5f1503c1320d8156746dff677cce4c8ad1c54a3301c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
37KB

MD5
63cc5e86f9403756a70a100450b13248

SHA1
1060cf135f0e3cb80780e11fd96b9c57ef2ca537

SHA256
b16c40d075aac5ffb60f10e343ab0657c86a926dcba4aa46d9278a76f9142536

SHA512
2f0370f84ba3bee8f3aa9aed6e0f6fa2206966ad7f78c786d8ee00a79f9f76774da5adf2152a543ff068663a530a9c14d8f976bff3589c6a27d4444c0c10540a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
65KB

MD5
3c702caa06c5cd93220d32bbbb94933a

SHA1
47b5a1b128a40908dc136287cd350d0e9234553e

SHA256
ecbeedb225da2e9fb3ba5a3268ec98dda8cff8c5c729163b0e89d797ff0e5674

SHA512
791aa9993914e4749d69496d753c0cf417388da1376951547eb652e02393b4eb9008175a0ba66b4087cc3dfe4bd8b8b4e378c21a7e8b21650b1063d0ee456381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
27KB

MD5
6054edd85192049a19ea22b2788eb4ef

SHA1
46e5febb1bdf96ffbc1d7dec975815ef18a0acf9

SHA256
b90b34f6d7c2ecce7952f2925cfa756101bd53d1fc7f875308f30ed73f2b903e

SHA512
1b7098d011f805fe264b65969a6222ca67e6e24efdb0c2d7dfc7857b7152851fb1f947a698dd3361f153e29c687a456e990f0511d56a9dd79e5a1ae24826c286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
19KB

MD5
651421320de5f942a6048b627fe38f9e

SHA1
21edf148140cfccad4b2f64fd93491cff578be30

SHA256
eddf6b9b64a30cd3371e73ee55ac867b65c7da580e51e79bca5f8bab8f7317c6

SHA512
34bbd7c1ebda4563d19172a16882586d8b3e03ba76e862680a90b5515186a91e811d835976cd06e5c5f1812eb1f90e38a311de40db3e43c94c2b237f21ec23db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
21KB

MD5
d9a283287a02a477148beb47498efd32

SHA1
111ba6e24ff407927a3d9df3774106a18f658fb9

SHA256
17a7ef68ea0e88082ba3033041ce5a38f1275f25d37f122a99a2a00651a2356a

SHA512
32a7b4b35a67306866636652cfe84c5b36e58a1c4c6ed527af071aa6e3d532f77de84e1693c9037a72a08b53c20759304b62cc20d7beb671da54de0ad7317a9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
31KB

MD5
ea23cf0722d8b304156a0fc2f6ee65a5

SHA1
e306356f01ff18243d8bec33a67b8a5b5d6d3201

SHA256
91fc63814157bb1d5dec2110fcd3a12b366066c737bb01be2dc9134fa6354ffd

SHA512
e93384a505719183f3bc953cdf52a1c0d233d4d8b789eda1ddb6d0a6ffcb1a3123a96e450ca55f54cbc14f4517941decece3b8d67c30b0521fc2c43ad1ffa73b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
91KB

MD5
087f225bcca1298489a596d8ee9b5559

SHA1
a9c01a1b61b74399122c38dae17556dc391a2e56

SHA256
94147bb9765337c91d578519c5f776b57f232f1c6a081c024081dcfa8023a4c4

SHA512
b60b8a9d5b5c3961333f1877b5b1d3a8fc32c79b348e3c9ab92e476dcecc634b748982a3b721420e79afb964fa668671097f4cae2fd8763328c0c3efe41c0d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
91KB

MD5
b556a381a84818eeaab98d655d5047ea

SHA1
098757fe5107a9d495ffbd809e4ae9ca928e7543

SHA256
3a3a31ed89abdd6c8c4f3c4b927b31eee7e37e53ef1f2308992d62a85329b1b0

SHA512
1d48454773968d1b6aff55d56ae323bc250bae86224a26ccd6d092cd7eddae8ea30aedc531e16c0989baf734d4b1fa9938b0b71c4708966a2f8ecf1fe40d915e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
220KB

MD5
e2dd7b6fd4aa0ae4fafc5b31e00e8c97

SHA1
28b5c94dae88ae44f5da3fc5febd7ad928de11e1

SHA256
dd97acba2026ff4a1f097a29eca1ce3ee54408b55867797a8623728e9fdfbcf5

SHA512
539ae78c6e287499f8d9eaf27db0ef1f5e4b7f74512db243546d996568cceceac99070ea0332ef7ebbf6e127c87819158c44260ca6493cce9fd23acf2bab234e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ff814a77f67aa69398f1eeae24e8d228

SHA1
88c2236149130c93ea363ecca2e0d1ad8ca146e6

SHA256
710269a42e9193a8847656b47c09b43d440183b4cc12f6a29980ee2f92c4d818

SHA512
ba879109c68068a4af7625b47604a4ca2d9dac5c44b0ac2a70c0d1a6f18ce995d400f991d221afa1e263f61d9dd4b95a51fdb827500c66c7c3a1b0abb9d1f9aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
31255d9e04be1d07c4d4ee621c71b808

SHA1
10c47e3fd5a4a532287f01188615a671c5f90dd4

SHA256
6cd9112aeb84f7ccb9503a7ebe8cd48d329710e29b15f93e60107452984bc9bb

SHA512
4b872bc9457d40a7753ee6b753a38a427141ee9701d52f175f7213260439f23dbd89f72c7b2cf6af38881205dfd76f2a63e3056571fda97f0a509312e3f1985e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6c266b6d6463bca90a3aae1f26a7e24b

SHA1
220eca49e5a41bfa3e43c120b21c3b6cbec30c32

SHA256
24c4e58ad0214534c54531c376f88e7cc64c670a8c0bd72ad8f40029c6bdffb4

SHA512
454773d8f631fe77d6c2460b9221af920d0dce00cf3c58b83d339c9853679237db26cf8c139beaad4d2b7b02d03ad16fd8dedca606458e62b6b6dc260dc245d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
841db1e3799d4ac4ceacf41e016f4ac5

SHA1
42c9c34359513731e225b0d16c12b6e5e4a6360b

SHA256
a3da0cbfb05689868f1251f55e4458553681c06b7580f0370f5120ff6c061414

SHA512
09cc9ec3198158b7c870a8846d2dc475215ac6f6be4b34ad154ba0abf413ee3a48ae19559423ed46b1a3acab893b499fb44642a93c76d0bc46b301bd8b632dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
57148ac853d47f1f649012d43b66bc27

SHA1
38c508dba7f24b6e4065ef809534e0d0388b0ef8

SHA256
6013e5212b638cde8c8e7bf357eb8016d88ab3c4eebb52de2cf44f02c6881ad8

SHA512
0c03f19d3ce1e2106aa2fefb5ef71e979a0b52a679849fe1dc6e83d88f1f367694216955773237db5be3bbc8d3ae270a272363faf297d3c7554212c3ce5fda0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
366c1b74912d417076638fab89cea0a9

SHA1
3c666662924784ea9280eb106838309a3b1b3745

SHA256
983fa912e12d2da82fb9e7a31a55b43cf9638850c98155b5c0b5b64d7bdd83ee

SHA512
1156f29c0fee8d38bb49d8b2053683ae6b13e36d696a8656080209f05c18b8f9a1d82ed11711d10e868a9cf25c4dd0e2dc1c4936f583cdc13c6f141e822343b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
c8db6d1057c6686249362f198ad404a4

SHA1
fbe7ba481a6cfd3078655a8026301f06007eb4cd

SHA256
98f040acacceb85b08f5cc6afd0be9d3ca7d27cb087c2532c22da955230ad481

SHA512
858f1a6831f91667d6e1932bd7afd742668c598415276ca178e5f12c60cc822cd5399d4a3b9bc5270d2b25e8f7bbd09ad1fd6e4d5c766d4caaca8d6bf16edc23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b14fc22718fe66e0d16444e538218476

SHA1
0e398671cfc7b38521b3940911cb0cdd2ea92b60

SHA256
3569e6f26f74d3949f77311f4cb17912f880edfedfb5323b0b70b75293ed68df

SHA512
2402a86642ad3fb3face1200005b44f92d4d8b62684952834c16daefffb45bb304a90df044c6fba0ced2499b9f2f3a8a176dcf870edab7635f4585ec37704194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8d2740ced5ae582d40734886940329be

SHA1
b631e368a12cda7cd51cda83ed5b2ef1857dddf8

SHA256
73a343d7751979f3fdab950135446e2e32c20154433dbc5d61427643fac72482

SHA512
f4051e1143a16699c39441add33980f5d8e09919a2795a74681d6c6ec9776469cb56c548ec78bb888e0b55f004dbceffcdd3b8a34585512a8ac0b96233b33bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b075cc3174e276b358dd9691d4bd87be

SHA1
44fb6113f7415cc95b85e70e45ddf925e469044b

SHA256
4212e7631bc7eb7a56efaf7799d336ee012eaf021d4be608784bc3d060438b3d

SHA512
9bb83662f7c3317bfb5144c44b9c51cc959bfddf2c527aadcaccbb0760baf7e7d007f081a3229bb0ffc065d3ca12e866471a609f36c97e5ee6cfd90d50e18a30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8877ef4a336729ee1d4bfcf472ff136a

SHA1
6766ff42a331a7655a922eef1436a03dec421979

SHA256
0c06f7222bb6d8074a43b7c60c3bf45d1c7625d910cdcf73011d3a8f7fa8a7de

SHA512
e8ef848bddc8fb4cc7578d35c88e4d94982e34ae317afa0b22ee522dc961f6c5e6e2bdf9007a1f8c34d2fa1d4d52e7d67acc3cb2484d0389f043de5373ec69c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d739714a0a958a8b7552846acd1c8edc

SHA1
b1460ca53756a8b2a396c2f41ee9c9117d8cd3bb

SHA256
c60b731f033e95177d23b230070a00034e79080c424e536aff998a5ab1e1b4e2

SHA512
7a060ecc47ac75450c0776d4de6a8f26d196738df25b4f95d8e84be6ee6f8d1d96f33d1fd5f8b90bf9dfcb233b47f015e2cec21cdf2589d8d01b1f83ffb9b883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
392b9df267bbc8d1232dd155e865b2fb

SHA1
49f725c47a33cff05ef1e641648e26997f7dc670

SHA256
d1e2d4c9168d3fad4f199e1474a6f710f32e767d220c04d9ff79043651408517

SHA512
45d50b173e92feac7279d557454d7ba23feef03994df472736de0dad2f9a346ae73025227f09dfb48cb460b93bc4e203f2cb73d3db2b8e9e78a1149ebba22429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1c1cc715c354ad3c7c3e99f30daff2c8

SHA1
9324685fc8f098308cd0cfbe0182112eed81ada2

SHA256
c5895e60a5c2b45c67bb04ff404869d7fd84ac919da1ec1f4f5bb93b7ae02a66

SHA512
ad9a44377519aa35974c5bdaaf37a1496cd4496e2ced142ccfbdbc4f702abdbcf8d2e5aaf3773f97e732192073fb4b411f8ebaa840201f8bf94bf9deadee897b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
82b5df28b4cace972ea2edb787bf9164

SHA1
742c94f8f0b47aa26a083d2be4a1b0b8a0fb2c15

SHA256
1d11885b863b4d4b9c1458e2036cc4cadd99dd55bf12198bfc457ecd6a62133e

SHA512
6d36255fe08b1dfc9f7cf5c7c5633725c098b7d2e41fd4f3cef9b871a7dbea7404ca936824778dc056dc9bbb0579d3bbe5f70fdea1eee6a76ff1e4044ad85628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f5c333be53b2f0587ad70653d1794507

SHA1
bd2f289d95532a62d4f95c791e2660f1e00f5a9c

SHA256
28b427d8cffa5d5e8070809a4cc1b5969176060970b12cada045c30434bad8b5

SHA512
b9f05da25ba9d2c340a2a087538d53570c092d051ebe023f0e6ff0a78c1f0f84dc0a84672f487188698ac1e473edd3e0c75d3542282e83c991af0845c54e26b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5e62a6848f50c5ca5f19380c1ea38156

SHA1
1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a

SHA256
23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488

SHA512
ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\53ad6094-a3bf-4454-8617-1c337bef2e90\index-dir\the-real-index

Filesize
4KB

MD5
a389b7f75b68a4a79145ea7f2f50da57

SHA1
6c9caad4d619101a3dfac8da4feeeb82e9bf0589

SHA256
e5908211e61c810dcfb01a599dfabe3cf92b25f6b43a2860f58a700db6dda263

SHA512
cc2aa277dd099735ed75eebaf3f30c410936655c975c48e20327e4c623595f2c03e101516f60a562897c5a975c7671f84d16aba6ff2d6183eac16d5b4ed47990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\53ad6094-a3bf-4454-8617-1c337bef2e90\index-dir\the-real-index~RFe592e59.TMP

Filesize
48B

MD5
16bf24163ffe0860e0cf66cc2a2a5344

SHA1
f35362a2ecc1af08a6d00d05b3b3b525e14844c8

SHA256
f95096fda5fd58ac4a9e5e679e9c5880698b5f4894aff24d5b1e577d9c4ce024

SHA512
215eb0127de14d37cb5534b65e547b8a77642b0faa9b0d6ecded34fa5a6f700de50b571050ad023441bfbdcbf30a6fb5aadcbc0fe77047efc00de3bb433c0ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
8b6557f3fe94788f9c123495ec791cc5

SHA1
d2a02a8c1ca6aafd162c63a1df46c0ef31d7d672

SHA256
d68677a727666acb163deef67705de131ce8eea59cb5db67ef305652703f6846

SHA512
3d5a950523c9e5bfe8b48ef674ce3f4a6840783627efb70b5a9574639e511323fac944e879ce50011dd438e27d495d4b7eb5b301d72d9cb2f1c20298ac11f3c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
dcb789accb9fd93fcea060d458a8890a

SHA1
362aefc6f394fc66ba2fa54febb7b36a9180c6f0

SHA256
6e5c587fe6871757691e9dcbbf15a456b45401a24522f12a2cb351c50e3ddfc9

SHA512
f2fbe96523c4032caf99f609baad5bea09a9dba33961528964118fdc9b28422e2f5e171af5a31944a5c36f49e1fdf1aa1e3c68b72a57f43911dcf258fd6b2fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
684fb4d66f2d1ea25189dfde8d10eef7

SHA1
9f39771de4318e50b077b24515577918feecf95f

SHA256
aa7e0a1933286f68a30e25379df31d92e508d9d11b86361b6babb27210bac023

SHA512
a53d28f9f74759297eaa6bdd1527308fc413f3906f974e5479ca6f257c813c3cb4d121663a53d5fbc17baab148d6b0d28bdff00976553a1948576416144dcd4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bd5f.TMP

Filesize
48B

MD5
a7238a29d37e63c033aa2bac856846e7

SHA1
e7cdcf81b6bb53c409682867504eb2f842ed96c2

SHA256
6d725cbd4348d3ba13d4855a53a81f9921eb85b05d4697db0115d637d11ebe24

SHA512
6aa3ce92aa213fc86aea1b4b13b670523d202ca23b76a8de79bdb73ae34fb4d8b20c223b71f0b3c0908b3ada26fe806d0dd32eb30fc5c2f7a0a79903987643ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
34722d1d6567869bfd269f5d472699d3

SHA1
94c40d1c0ce1df8d3e024165459b95b1c86c4989

SHA256
b0c4f6ae6f02a832a1928d03f2728580c412912977ca52eae7ffd53f158fa400

SHA512
bb65a93a5678c9337c5a56ea2581c5cb9beeb4de29065694b0c04bc06e43f497604a3978e125213908cfbc8c2edc97a85e62445c7b8dc9a6ca36cf3d50a3ef91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
250e0b5364e583b3124bcaff6d898b20

SHA1
d4d43e8fbb13530d9125ec0fd64641d281151bd5

SHA256
a15cdcad1160a3f1fcf7a50e105620ddab37bf64fc60f9b99885e54b8355bde7

SHA512
693775a6593c9c975ae5c08aeaa687b0581dff5e828c068c9154e7b848d2ee2f2005a88d6bd27c41b7d0f73a16fa39a62d26a9bd53d9020f08ea7b83005fe01b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c74a8c98970074c3ad2c45e28ad969ce

SHA1
751d3e2906eb9fccbcef4f134b6dad1f3ad0c526

SHA256
a0d20abe977d67ca07239c69ae883f1369a12117ea347e69b3503eda25e34414

SHA512
3cfa7dc8ac3aeeaa556e1731fcb8c518a6fc507aeaa67b8e38d3afb32673a9e445ba616a9b3dd1680635244c5c5a99f058ed1f17d2cce0eda3f1363d66ea22cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6aca7e66b5cb85af18ee8ac58c22514a

SHA1
9e9ea59c1e20224cd91cc7f8b0d21c64a39867fb

SHA256
fb7aa1208e36d5225c8d55407968240fee866d817eb0b8b40388c17f84846ef9

SHA512
87466207aa8efa7c355cb014fbe3093637320780245498678a9a625ded70af7e03108967cf0408ad30d6006718056f6e0118da6890c2210fac5c7884a6c169b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6f0c0cd1d196bf4cb6ea523c0164cfe5

SHA1
6bd21f52cdf7d3a12a6cb497cd9ada77c2925066

SHA256
39cf9e5ac51291e4f63a8ac512c84412a912b23f0491d59ccae6c6f546621e42

SHA512
f18d847f9202f9d46322bec440fb07d4d0f79a76b183978ab72a41c224789185972b2b02be53b826d5f0a2c0977482e5ba26e500af0eaa8e6cccad5bc5fabe43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58841f.TMP

Filesize
204B

MD5
d05ee8e07a0fd1261467857b31c1c8b7

SHA1
e3ba25f52ab38a303f0d0a832a590538c9080c5b

SHA256
5e554b9e4f7e7396d7beb58b1f6f9b4f770fb54adefe9ae31425ef39806949fc

SHA512
89ebee9db139b36824a21b5542d408496a49f2ec9b00b420a849a416ec9245e8e02acdfb406fe7286062237d0e7057a5d82877fb8f2bdb1c9fc585f7eb0f3287

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63f6c1fadb737d6e7138c4bc829928d0

SHA1
799f630fc1b98af43f6469ad9e98b64dda1cd572

SHA256
4b08581bf53ab3608b62356ea2ffea959685039ac72e0b2a83190e4f58bdcf6e

SHA512
70b3d98180c66b4b0328ae3e664eb29f1f76d6707cc1e2b2f3d4c6e4cc0248eabc853ce4ff78c2f16a2a92fa3292ed75d12234b3053a0e7a150462b3684976ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
71f6137e5cee374ea3b6d57c19551e13

SHA1
e5f658f5c3fb86e56b2bd8d941c127b6a22e1051

SHA256
570cba840841c45f765ca4614b97eaf76732ae21123cb0984f63c154decac37a

SHA512
f098209915f9a6c56159cf09d52d5c8fd4590336c29ef83a06aa0f3b9de3a1e38e560167b1b9894caba0730f9100600e2da7731e86291ac2208fb7c0d9532d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
66f7cd4080e8c93a67fc8a7c7e724b98

SHA1
33fffc2ab15a19ee301c03b24b40765ff66e72bd

SHA256
32efaf4bb923a9a49e38705561da8ee6202a1358968a63c289229603472cc9d4

SHA512
fc90bfa1ced7983c1fdb2bcc7fa0f281628d6a0a0be70c776072687894d24afa5ff371aecbe2458f23e9519fbef0aedf74760d79be2df5acb58141f1bfd3a8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
99719626f175e2ae275492eb421c7429

SHA1
0b5a66fea082ef8d6e001ff24256b4623fcf5c1f

SHA256
dc533884330d94caaf68c1974bf82da2e8993886e1dda3eb72841b35e1012bc5

SHA512
ee6aeaf6d28222a62d7f5ff79de64214b6c39c9725d8649b5f593dc0046a4b0688613e09569612a4c94f55a4655e71b3afbfae1413c99fa0a3336c52ef2678b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
410cbbc5b98b56b9cbf55c7f7065bf09

SHA1
aacde3622ed4149f4a3a29b84b00c3b8b5b69ba4

SHA256
d4fce2a825d565f36e1877eeda16157edc5e7c0e6b1612a58a12b6ff7752b3e8

SHA512
5f9d504b447205b72215be53e0980f85c8dda0041c6eeff9ae002c70759b99f1b59ff54965e82c30f1a00c434ef192f4cbf0536f8f36cd9bdb2da39b76a5e19c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qmjs2eet.default-release\cache2\doomed\7772

Filesize
14KB

MD5
c9f2926a29f25eabbe9a4bab99a338ca

SHA1
1fbdd61280ae1a4a054cf13a84c243729722619f

SHA256
3685094b44bbf0d736f78f15ee7bcc1a2804f385f74565565d0ac5526b591ec1

SHA512
d73b03ee1e1f91f6498fc10c4e3df12719bcec990092dfc4139e56003a8e2dc95cbd6f34a4b333a03a393634a11e3327f7a48c3f7ab68829b485787383a672c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.7MB

MD5
e6785daa7440e917d830186fdcaebc7b

SHA1
bb46cbb6872ad4f3c617c6f54e87035a6554f8ac

SHA256
e7fd649a5f245e785b48d29e45f1335318289c9d392c838eda2678d6d6f99b14

SHA512
1496159a30dbde842e35e2570da7f027e7f217a8874ba381467b523e64383d7b12f0d5e6bd03cd993429a40165d7cb1360cdc7d5c179471e0a1b6cf1ef2a6924

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
925KB

MD5
5d56af62d42aad21ee7cc1912c47e294

SHA1
b9d89c787fbede70f4158b07b0b4a858e0f252c7

SHA256
8967626e02d81d8795e82265945c597d5900c90e4acc9a8d90ded8d1e1e43339

SHA512
83854adf8f81d9ecd697bc3100d4b35288f7a2b8992bdbefa570b1391cfb108b333b0009a42222b99dac8dadea3532117347c91069f4ef1ea8696f79aeec94e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
824KB

MD5
d846a7377eeb2cdf9afb6710aee268d7

SHA1
ed226a674e542a28c40dc740186826b2f544cd8d

SHA256
d7791202c5c0cfe2d8878a59e5e934cf68b7775908650ecb0277007f8070a3f7

SHA512
906aa61bb52fcff2a12c100fa40deeb61f6d892ad527096f1a2d1763bd636c6830da2489d8571f475cb8bce025d2519a2d13a1890013034f66a74dac5ee2c437

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\VCRUNTIME140.dll

Filesize
110KB

MD5
6b29197a0e01f203503302aa98618613

SHA1
a82c6493c3db2631db50f5d851a99eeaba6814a2

SHA256
cd938cae160d6a67148eb7314708245878122cdfb3c220e3f806f6c9785e8f9e

SHA512
9ac719cfaabedcae52fd4a93d8ee8fd42fab8957452befef169064606de19c567c0e5932135cc74568384908f818c762bb890002b5e1dfea9b57804ae8b08f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\_bz2.pyd

Filesize
78KB

MD5
8667f6db4ef3944ce8f984de8637e563

SHA1
341d786f666adcb881c97bc25e6f24377d71aec5

SHA256
0cc1737cbed33892814974c873ef5b1c48d0e6d9212077ba8a1a38d682fbff81

SHA512
88e859439aade7d57daa6767e718f7ed0ce975f6a5404e154d675f7445baced4b9c0cebc1bd648828a6cdf54113fb83c27882146ee3ffd410802689b1a1ff6c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\_lzma.pyd

Filesize
96KB

MD5
71befdca448e68ce55530ba139e41112

SHA1
129e795792b232f79a48dca638693b8a1cf6711f

SHA256
f465fad2be4b5a25995dc6e79c47c693935af66d662d0cca69f44a419bdc3f68

SHA512
1aae8e46b64490518b92d01b25ae2b4573b980633f863f408ea726cdacea3d2b06e284c5bc2afac16062ed09b08e0145fe29329b312b370f7286feb530d42587

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\base_library.zip

Filesize
289KB

MD5
3b0e2981b49128f161215dad55c1da9d

SHA1
78d5b8e24e12adcaad493ef14e92fc6d6ecaff64

SHA256
204577b80ee9d051f91a145e24cefcb2a3e2205814c450f551c471ace1c993ac

SHA512
40b6407365b71f94c2793c976dca63e466afb7cea740f92436a7ca15cf854995dc8b543a4ab17071e1526d2a29578c299f278b9ec28365bc2fe42ed752bc3372

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\libcrypto-3.dll

Filesize
392KB

MD5
8b679b29190ca8bef074df9b16e12ead

SHA1
3edd955152e4878826a67a8f048941fb76b1c1c7

SHA256
479e3b159ba49b854a493a73e79de909f219bc44a01898244b5ca4e9f40899de

SHA512
eac5a14e72392016bbaa3bce85be3d3db48017a0d148131ccfb16a7a0b4c2d368df42cc3aa4ca0fb3e264f541b76ea28dc31436d281ab70ba7e41c2128b1f8c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\python312.dll

Filesize
345KB

MD5
d7cbbbba014e0e3ed04450eb905cb033

SHA1
66273d3661f8228a74f859e9a0b4f943b96213ea

SHA256
e98a453d188e362ad499a5c8ee13d54513f1f442a4661bf870dce41f2b6005a1

SHA512
0dc7ec8f290f0015e136ef10dd6d1620e239a7f04127f66f03fb239b11677e2f0751f7bc1123e5809ad64e65e69c3d84b57f07d52440cbd77a147be6e1f71993

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\python312.dll

Filesize
412KB

MD5
b4e465db3048548f3699d74ff09d1b17

SHA1
592a7bab319c1aae1b280df3cf9b145a5819bf5b

SHA256
deae968728d4025470fe0ebd31c8b575aa2a93f2158ed939a4e45b6f789d44a6

SHA512
8f85bac9b2644e3fbdcb615d8f66485bade3276c2dca5c5b178e0414f8acc4ced39a59bfd9636a9964905089f29a123c35411fe237e6429761aaf04dac8b2baa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI37962\unicodedata.pyd

Filesize
427KB

MD5
cb7e0fac65a4edb85bc14cb3fe8bdb12

SHA1
348b5d8b56c86aae3a08a23c24a66204e48783bc

SHA256
4269a22aa4a46083220b369a0fdb53a798646e391a592f512a7d54f16dfe3fe9

SHA512
4b2b81404e5876711c542eb380c8c584e70b530b6c4a82a1c385f196894f36e1354c88308432d5b933fdbe1be2b6b50f9ffa6a3283ccb144cc01c3226c541c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5hlmwttq.z1d.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE5EB.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
536KB

MD5
f6bf6ed24c646735bd58eedce46c6236

SHA1
388867561bdb2cd9092995f41ba93ea3407ed930

SHA256
76b791fd1645923e41466097b6ec4d4e11869dcf9dacf87ccd801933415ed547

SHA512
a34096bf8c97cc5c6a72d9dddd44bbcab4625d91f760d81cad6ad03182dc6969adb386342ba544f32a92398fb471eb0031652fe7ea895343977f89722f086ce5

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
397KB

MD5
cd8d17f9fad29a54324be015a5102d92

SHA1
18c27d145a961a23b28590acb7a561ca91db9d90

SHA256
04d53956993df89b6f724d4ea03f7b35b06916d7aa823755c2aa3f57539d5a9b

SHA512
72345a3c6192eeca3945c8a2f76a78164a0b183b87f78858fe8dbc75131a346fc74af952f36f8d2a131b424ee155532a1850a583aab6801f8748ecb24f6e51ea

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
84KB

MD5
794cf0e21faab581526dd203bec8d60e

SHA1
e619116b476f50a5190a1d636c59215ac2f84385

SHA256
431cdb434ed7136b45943102aece353a38ee9efe1a59894d1357de99d5da3b75

SHA512
e5ddc0f41ea1cdc8081f1901ad5375e9cd53b879d57474251eb2316824fe9ea8f1801142b646f96f138841c21151cc51860e21a082a6a9e3efdb89bdf36f8012

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
382KB

MD5
c939d3f1c9c71b0d10be3a7fc661da3f

SHA1
249e15a6da44fedc888ff71791ce7bb659c436f3

SHA256
9e12c2ccd14c2a76bd0348041954955595ce2aeb9af1c21cbb7bb3af39bb0208

SHA512
151d33a5f38e5f1b8b5b3d3e98af9d7853a800f22f7d81274658669b82f922f3b564390083582a20de97ec803624c243b8f655948c6b409f6ece981bc8402ccc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
520906374fb9ddc34b226600355fd321

SHA1
6117d18c19d8829b9eca0cb352af09faae0bd1a0

SHA256
935d3c468f5c4d3fb963da989e4a7c033e73ae07b0fea0175ef89b18c7b76772

SHA512
62f1b65697c0141ff38900b3e085c94074a94a09b08e6da74f47864fcc6140355ff2dfdd4072f38dea3ce81a6f7933c908fd43b420441c2d2f500b1183149470

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\datareporting\glean\pending_pings\8e2b6dc0-46d9-4fc9-9833-f18648957cfb

Filesize
12KB

MD5
bfe566084676cf66fe25570e365bc9cc

SHA1
26dd712cf2600a1a8d760ed75c6ac323f3a7c4dc

SHA256
292d5abaae65685f62f6c7ca645f8fe0955553d10f1151d33ae0434a015c5701

SHA512
313ea5bf3c1c657d919fff0b269d00a7cd8a4eb29b6f5bed8854841ff555f58d3449ed886ebcb035231efce0c4ea4cd644fc2ec27976d694c7eda662b0350695

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\datareporting\glean\pending_pings\fd6ae348-4e13-4a2d-b974-4470933db29e

Filesize
746B

MD5
74e46beee98519069d0219c87af84939

SHA1
60b0a294e980dafd73ef52dcb7d2e17513099bef

SHA256
7d0c7f4cdb824260f4a8774ebd0c68ee6cbfd3f02421b0fe9e8f35c9ddd93913

SHA512
0f982e34902a6480d17e56f8bd0ea84e8dcf0e32a4165bea4811328282eb202cd18b623713022bac69294e0e13e15880f0381c06ae881b035056dc081c27e771

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\prefs-1.js

Filesize
6KB

MD5
de06c7e69411663eb77751368a578d33

SHA1
35a7c9bf018aadf4c3397f9474681fa5eb89cc42

SHA256
c754a9ce7a3bbb8d9db0ded2cff678fb88bcb20d9064ee8df28326cc3aac03f5

SHA512
f4f90495d1ca0bef789ba23affc9947897be25499b6ef3783cfee9b8f90aa2b3a80e1e707229537d94988c150e49aa7ebdd519933840719e825e55732a6bfe42

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\sessionCheckpoints.json

Filesize
193B

MD5
2ad4fe43dc84c6adbdfd90aaba12703f

SHA1
28a6c7eff625a2da72b932aa00a63c31234f0e7f

SHA256
ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933

SHA512
2ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
d50a27efe259d21b236a1f0e76683fd2

SHA1
50e61c8de44076e0208f3c5b1f2c94fd27dc716b

SHA256
10ef2ec470bb56723ca23c62e246797cb88a807932187829af628461e8baa459

SHA512
8eca3d4a6501c4adf93b38d224e78960df438ae26ad1694b72cfd501b97246b990e224266dbc1c80a8c18629f8901d5a9c2028d7fcd737534657b68fa61be9f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\sessionstore.jsonlz4

Filesize
933B

MD5
5ca489a34584445bbdbdba98d321a156

SHA1
a6a4a1f00475bbd15816a68f45de12726e23e69d

SHA256
bc41283c49595286e674e2066bb56704e8a4d042777b8e5141d31a7d227f09e0

SHA512
9d76d76dfd17e060560a7beaa4f6eb142125f28de46e666b9f3f44a4edf891fc8390930a26584f031c10b3f859adcb862d16813622cc321bc3dc631b6e5b2732

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmjs2eet.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
64KB

MD5
3021ed72036e5ce716ec38632daaff2b

SHA1
b301f7aa86c92296ce205691d4877bbe745a84e1

SHA256
236cf27359d9ff1bd92a29a392b62d6a6555c1a4c64f3a1cd6498437936b7b06

SHA512
b3b8caebf4eeb14dc31ec1656f799c1d3c903504c39cc9ab7b898712aff6ce898f84db934f43f550b3176b8c789f378db7cef60a1cb94911fc8d4e6b0bcf411a

Download Submit
\??\pipe\LOCAL\crashpad_2924_GBEUFGSIPSXOUAXX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2084-1889-0x000001965A190000-0x000001965A198000-memory.dmp

Filesize
32KB

Download
memory/2084-1886-0x000001965A1A0000-0x000001965A1BC000-memory.dmp

Filesize
112KB

Download
memory/2084-1892-0x00000196414C0000-0x00000196414D0000-memory.dmp

Filesize
64KB

Download
memory/2084-1888-0x000001965A1E0000-0x000001965A1FA000-memory.dmp

Filesize
104KB

Download
memory/2084-1887-0x000001965A180000-0x000001965A18A000-memory.dmp

Filesize
40KB

Download
memory/2084-1867-0x00007FFB5E110000-0x00007FFB5EBD1000-memory.dmp

Filesize
10.8MB

Download
memory/2084-1895-0x00007FFB5E110000-0x00007FFB5EBD1000-memory.dmp

Filesize
10.8MB

Download
memory/2084-1891-0x000001965A1D0000-0x000001965A1DA000-memory.dmp

Filesize
40KB

Download
memory/2084-1885-0x000001965A030000-0x000001965A03A000-memory.dmp

Filesize
40KB

Download
memory/2084-1882-0x0000019659F70000-0x000001965A025000-memory.dmp

Filesize
724KB

Download
memory/2084-1890-0x000001965A1C0000-0x000001965A1C6000-memory.dmp

Filesize
24KB

Download
memory/2084-1881-0x0000019659F50000-0x0000019659F6C000-memory.dmp

Filesize
112KB

Download
memory/2084-1868-0x00000196414C0000-0x00000196414D0000-memory.dmp

Filesize
64KB

Download
memory/2084-1869-0x00000196414C0000-0x00000196414D0000-memory.dmp

Filesize
64KB

Download
memory/2848-342-0x00000000077B0000-0x00000000077BE000-memory.dmp

Filesize
56KB

Download
memory/2848-58-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/2848-231-0x00000000071A0000-0x00000000071BE000-memory.dmp

Filesize
120KB

Download
memory/2848-236-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/2848-36-0x0000000002C70000-0x0000000002CA6000-memory.dmp

Filesize
216KB

Download
memory/2848-232-0x0000000007210000-0x00000000072B3000-memory.dmp

Filesize
652KB

Download
memory/2848-213-0x00000000071C0000-0x00000000071F2000-memory.dmp

Filesize
200KB

Download
memory/2848-263-0x0000000007BB0000-0x000000000822A000-memory.dmp

Filesize
6.5MB

Download
memory/2848-267-0x0000000007570000-0x000000000758A000-memory.dmp

Filesize
104KB

Download
memory/2848-273-0x00000000075E0000-0x00000000075EA000-memory.dmp

Filesize
40KB

Download
memory/2848-211-0x000000007FCA0000-0x000000007FCB0000-memory.dmp

Filesize
64KB

Download
memory/2848-286-0x0000000007800000-0x0000000007896000-memory.dmp

Filesize
600KB

Download
memory/2848-53-0x0000000005410000-0x0000000005A38000-memory.dmp

Filesize
6.2MB

Download
memory/2848-52-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/2848-393-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/2848-158-0x0000000006270000-0x00000000062BC000-memory.dmp

Filesize
304KB

Download
memory/2848-156-0x0000000006240000-0x000000000625E000-memory.dmp

Filesize
120KB

Download
memory/2848-359-0x00000000078A0000-0x00000000078BA000-memory.dmp

Filesize
104KB

Download
memory/2848-364-0x00000000077F0000-0x00000000077F8000-memory.dmp

Filesize
32KB

Download
memory/2848-62-0x0000000002D50000-0x0000000002D60000-memory.dmp

Filesize
64KB

Download
memory/2848-140-0x0000000005E20000-0x0000000006174000-memory.dmp

Filesize
3.3MB

Download
memory/2848-215-0x00000000740E0000-0x000000007412C000-memory.dmp

Filesize
304KB

Download
memory/2848-350-0x00000000077C0000-0x00000000077D4000-memory.dmp

Filesize
80KB

Download
memory/2848-297-0x0000000007770000-0x0000000007781000-memory.dmp

Filesize
68KB

Download
memory/2848-134-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Filesize
408KB

Download
memory/2848-126-0x0000000005A40000-0x0000000005A62000-memory.dmp

Filesize
136KB

Download
memory/2848-136-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/3608-114-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3608-1880-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/3608-116-0x00000000048F0000-0x0000000004900000-memory.dmp

Filesize
64KB

Download
memory/3608-1870-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3664-149-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-83-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-161-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-159-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-32-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3664-1812-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3664-151-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-153-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-186-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-145-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-179-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-147-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-143-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-138-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-120-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-135-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-171-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-155-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-132-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-31-0x00000000008F0000-0x0000000000926000-memory.dmp

Filesize
216KB

Download
memory/3664-163-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-167-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-99-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-183-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-181-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-63-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-165-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-169-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-66-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-177-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-89-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-60-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/3664-59-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-43-0x0000000005100000-0x000000000516C000-memory.dmp

Filesize
432KB

Download
memory/3664-115-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-57-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-173-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/3664-175-0x0000000005100000-0x0000000005165000-memory.dmp

Filesize
404KB

Download
memory/4036-3317-0x0000000001BD0000-0x0000000001BF0000-memory.dmp

Filesize
128KB

Download
memory/4036-1922-0x0000000000D40000-0x0000000000D60000-memory.dmp

Filesize
128KB

Download
memory/4296-1846-0x00000175F7B70000-0x00000175F7B80000-memory.dmp

Filesize
64KB

Download
memory/4296-1844-0x00007FFB5E060000-0x00007FFB5EB21000-memory.dmp

Filesize
10.8MB

Download
memory/4296-1845-0x00000175F7B70000-0x00000175F7B80000-memory.dmp

Filesize
64KB

Download
memory/4296-1838-0x00000175F7B20000-0x00000175F7B42000-memory.dmp

Filesize
136KB

Download
memory/4296-1854-0x00007FFB5E060000-0x00007FFB5EB21000-memory.dmp

Filesize
10.8MB

Download
memory/4412-85-0x00007FFB60260000-0x00007FFB60D21000-memory.dmp

Filesize
10.8MB

Download
memory/4412-56-0x0000025D467E0000-0x0000025D46834000-memory.dmp

Filesize
336KB

Download
memory/4412-88-0x0000025D60EB0000-0x0000025D60EC0000-memory.dmp

Filesize
64KB

Download
memory/4412-142-0x00007FFB60260000-0x00007FFB60D21000-memory.dmp

Filesize
10.8MB

Download
memory/4752-64-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/4752-113-0x0000000073740000-0x0000000073EF0000-memory.dmp

Filesize
7.7MB

Download
memory/4752-30-0x00000000009A0000-0x00000000009B0000-memory.dmp

Filesize
64KB

Download