quasar | 7426bfffbdfa22967e0d7570ba07fb0c821d0b65ba6aa159b3798906bf3846cc

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loki/install.exe
Size 3.1MB
Sample240426-3tf66aee97
SHA256 b862d153c5fe9106983a79821c87ab071bf9a7c2492ca378764533cd05784815
MD5 888ceac60d45c11a1a8da876c3555247
SHA1 e286dd46646036fbe529a4fed2ceff41f8f00e3f
SHA512 daa02e6ae8fd9c17b25b93bfd5eec539a6bbc081dbbb0a5507dc9f0019838e83974f9b1b55981318af3c5e3445c3e754cb16a1a83f57e2cbf3115c34f1f3f34b
SSDEEP 49152:yvFt62XlaSFNWPjljiFa2RoUYIiTIcEiOTk/fLoGd0THHB72eh2NT:yv362XlaSFNWPjljiFXRoUYIeIC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.0.102:4782

Mutex

eac23e77-c75f-454e-844b-09c00c9fa1bc

Attributes

encryption_key
E691C3454CA7E584A0CAEACC33DE2648D0070D50
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3120-0-0x0000000000E30000-0x0000000001154000-memory.dmp	family_quasar
behavioral2/files/0x000b000000023422-8.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1836	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3052	schtasks.exe
2784	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
5880	chrome.exe
5880	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	install.exe
Token: SeDebugPrivilege	1836	Client.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeDebugPrivilege	3676	firefox.exe
Token: SeDebugPrivilege	3676	firefox.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
1836	Client.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
3676	firefox.exe
3676	firefox.exe
3676	firefox.exe
3676	firefox.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1836	Client.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
3676	firefox.exe
3676	firefox.exe
3676	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3676	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 3052	3120	install.exe	81
PID 3120 wrote to memory of 3052	3120	install.exe	81
PID 3120 wrote to memory of 1836	3120	install.exe	83
PID 3120 wrote to memory of 1836	3120	install.exe	83
PID 1836 wrote to memory of 2784	1836	Client.exe	84
PID 1836 wrote to memory of 2784	1836	Client.exe	84
PID 4992 wrote to memory of 2408	4992	chrome.exe	89
PID 4992 wrote to memory of 2408	4992	chrome.exe	89
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 4264	4992	chrome.exe	90
PID 4992 wrote to memory of 2684	4992	chrome.exe	91
PID 4992 wrote to memory of 2684	4992	chrome.exe	91
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92
PID 4992 wrote to memory of 4032	4992	chrome.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loki\install.exe
"C:\Users\Admin\AppData\Local\Temp\Loki\install.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3052
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff96f98ab58,0x7ff96f98ab68,0x7ff96f98ab78
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3144 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4320 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4672 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5020 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4964 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4360 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4628 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4332 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4784 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4236 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 --field-trial-handle=1980,i,12097652296302567560,13545455122327874162,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:412
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3676.0.1260986444\910590408" -parentBuildID 20230214051806 -prefsHandle 1808 -prefMapHandle 1800 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a34aaef-f097-43f6-bb83-6cebe517abc1} 3676 "\\.\pipe\gecko-crash-server-pipe.3676" 1900 12797e22b58 gpu
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3676.1.1096711844\1081286226" -parentBuildID 20230214051806 -prefsHandle 2440 -prefMapHandle 2428 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff67e852-f8a4-4fb9-892a-b240b474d5df} 3676 "\\.\pipe\gecko-crash-server-pipe.3676" 2468 1278b089058 socket
    3⤵
    - Checks processor information in registry
    PID:2380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3676.2.596678194\1259251380" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 3064 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1248 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c5991e6-3e19-4413-a56f-9b33e1b3f0fa} 3676 "\\.\pipe\gecko-crash-server-pipe.3676" 3096 1279a8e1258 tab
    3⤵
    PID:396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3676.3.1761842905\548273868" -childID 2 -isForBrowser -prefsHandle 4136 -prefMapHandle 4132 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1248 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02b3bf11-dc64-4baf-ace3-285984d3dee3} 3676 "\\.\pipe\gecko-crash-server-pipe.3676" 4144 1279c4b9258 tab
    3⤵
    PID:4660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3676.4.1399317213\1961677480" -childID 3 -isForBrowser -prefsHandle 4912 -prefMapHandle 4772 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1248 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3852690-9afd-426c-8aea-2e67b0367f24} 3676 "\\.\pipe\gecko-crash-server-pipe.3676" 4932 1279e11f458 tab
    3⤵
    PID:5248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3676.5.213400108\832596190" -childID 4 -isForBrowser -prefsHandle 5068 -prefMapHandle 5072 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1248 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b97d044-cbbf-4bfb-abe6-dd76cbc5b370} 3676 "\\.\pipe\gecko-crash-server-pipe.3676" 5056 1279e121258 tab
    3⤵
    PID:5256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3676.6.1462433239\197313262" -childID 5 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1248 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0353f919-e7b8-47b5-a33a-ffaa301c5661} 3676 "\\.\pipe\gecko-crash-server-pipe.3676" 5368 1279e11f158 tab
    3⤵
    PID:5264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 53adfd9d3339d8e2826d0f31bfc6c026d94dddd8c5e0343473189b2b9025f855
MD5 8dd1cfc1704ae434453e468dd4f3cded
SHA1 8a21dd4c97e2b7828fd97240901e6c3d67e5e047
SHA512 ba00e499637cb2c3d57179e92a96d8424638160ff6df60e61c7df6ac0b65845eea88a0887b18d9ab137ce64eda449cde38594165f2e8d7db85b5654d29bfe800
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 597f45f685352eaedca214cce5e9b37e4e091301daedca88ac4d098299e072d2
MD5 71c20da898cab33fe6a3b586f1cd00c0
SHA1 4e11094f94eca57f97de5f9af526d26c9c9343fe
SHA512 208c023a76ccb63e6f176d38d07664b2bc3680030aece4a1f4df60e3e059d8ed11a69ba09deb010890ba4b5912cf4cddcbc031d60a2b37830330c5dccd6a4b0b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 690B
SHA256 f578aa33acd8c91c8815969d3478b8d34760867b2c3b03b5bbb1a33dd6e821c5
MD5 f6d86f1d105cef19cf8054a8701d246a
SHA1 32bf89358a96833935c5c19c2a68b5a5d2815058
SHA512 dae2404168a08a9b3bc9ff3cd6f385e4033b2bc35fef8e2244ca46501ad652db6a95bb62ae7135b06663cf7da3e06a591f885340d2c219c583c98541857ff001
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 356B
SHA256 840a173014ae61067c2f14cbf3f19b38ba1b7217038c349968c3a01ecfbfa9eb
MD5 063ba8f90141de4f30a6f0aaa487970f
SHA1 2f75bd0149a6d86b782ce8b0a4e82d2087a01025
SHA512 6da0d564385f3fb019744ae84e608cc966166e5d6fcd407b76e2d8873dec8887384a4bc1fd5cdc015957b921e868bb2e666e0695986b0d52b0dc0ea5e385e1e8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 f36a693c47c3a86e9b9017da1191deaeb14ca5375639f3350e11371a03edddd1
MD5 375cc4d60aa91a5cab5a23797faeb33c
SHA1 99dba7a7ca4adc4f0b751150eb33209fa70999e4
SHA512 947170dcc8af0cde4580498f4eeb6c4ad3f766d1896fe631d8279cd3cd61626bf4e4b4149bdd9c65c213897aa8263847a23e0d892f81d72c1ab0225b9f180b03
SSDEEP 96:AJVkdTXELSSRFuKIkJAoSQI8iZRy7Dx+6MSmueBY1EO/X1GAXO2MLBVhYtjEsXtx:A/STUuVaJQ8syh+FRYzFOP+tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 5961e511ae85830a5657480a3ab640ff8ef3cbb184df2596aa0b87e32cfaf25c
MD5 413a3507efd177c5a017a96f6b67f1cb
SHA1 df1e398209980b7800b3ed42fa26247f0f8e3d8e
SHA512 11e4565085ea0e5ad3c3797535a8281bcff1b5fb1b4e2847fbdb04ab5d5b779bdb97e4773e32b8ffc5696fe93be9e3154b68f7981f94230573c9618c35545dcf
SSDEEP 96:AJVkdTXELSSRFuKIkJAoSQI8iZRy7Dx+6MSmuenIOU1GAXO2MLBVhYtjEsXt0/cR:A/STUuVaJQ8syh+F3mFOP+tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 5f68e410daed2362c3d91e92a95eca2ec419f10f6714b60d6be67434cec31a78
MD5 ef1abcc9df06fe5c051880b94cefcf0d
SHA1 4b8441563c6c5787befd700d2b66f138845443a4
SHA512 1254c509f6386b4d81d985577d41c7e73fb4ca74dd1dba43faa3568c1ad903eac3c0ba18b99e9384d120061e29bcfd7677ea0606bf742b980ce11b421c16d07b
SSDEEP 96:VJVkdTXELSSRFuKIkJAoSQI8iZRy7Dx+6MSmuenIOU1GAXO2MEVhYtjEsXt0/cgS:V/STUuVaJQ8syh+F3mFOP5tjEsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 292KB
SHA256 9b976b578f743a9592ed11a545fa2a923e24c5294fb5258c9d3963ba8c8636f4
MD5 628166ce70529056a609f081b628e236
SHA1 ba222ac6eb1c7e4b89e8bdcaafb0eb77e7766aa2
SHA512 7107b4aa1673e9684d9f6f8b10d04c53441e7e8d3c4df136fcecbeb632fb2abc01e13101210d94f85a912b4068ebe9fe62b1eeb8523be3dae81ca96291198b16
SSDEEP 6144:ZJzbEAGe9A96rorGZTlw4vDaQKrc82DvF9te35nfC5mgMatp2:/4e906sSw4rH8qvFu35tgMyp2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 eb3f47400014f1492fb6ed66ea025c179234010950d51727e8e09616d48ce3ab
MD5 b7cdcb21e8544c338775fce2dc85f173
SHA1 61e7751daeea7147bdc23bea5af9597dbe21fd41
SHA512 8e0718ad33dd2a5e7e8134a5585b0671832673be32d7007642b42e4e5beaa904acb70513fcd95513f5887dc6bcfa2dda27ece8e249607dbee79964488b8ae31d
SSDEEP 6144:FXGe9A96rorGZTlw4vDaQKrc82DvF9te35nfC5mgMatp2:se906sSw4rH8qvFu35tgMyp2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 98eaff5b2443ba71e0b5309140c543d1deb44139687086292135c46cfd62f51a
MD5 2c6d8edda5bdd7176302f2489e905bf4
SHA1 7c579979ad70fbe54dd360c2ac25ba90c66b309b
SHA512 cab87a2262c4983aa0f7ea060c9a9b620cfd50dc9fc0505965ceb37c73878741bdc80c16b75cfb8c8be718fc025ca5f4102b0675551703bb65278370231f41cd
SSDEEP 3072:PrLwnz4F9teZuyz1nUI3S6v/UDr3dLDiuhcwaGqrksatp7:vvF9te35nfC5mgMatp7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 258KB
SHA256 3a9564a15f348fc370341dceedf92e2c7bdbd300d2197dbcbc8b53babb2e6a46
MD5 e552f30e4b6a4f889aa6d7098c466410
SHA1 702494277e83db45c07bddba5b347463cd140707
SHA512 29aee0fa76dfefd6ba525b35d91849a7663050e2dbcf4edd6ec6c8d851de88c7dd5b5c516f940e461e0b41be16264933020c66845bebf4a264d76a68160ad4fc
SSDEEP 6144:wGe9A96rorGZTlw4vDaQKrc82DvF9te35nfC5mgMatp2:xe906sSw4rH8qvFu35tgMyp2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 93KB
SHA256 2ca7a9442e471001d3c5d5c1c01ad42d2b5637b5d657ec14868778d37db7536b
MD5 b09dbb1c34bc628d784f1e4866a791d1
SHA1 a863f370d7c3bb6af08e0b8462f17b4bcfe4d8a4
SHA512 d06f749b56af41aa6b5a01d2a06f32677c2aa0e78338a3642a298dcbbc99933276bbc4caeb5fdf8bd415fee97661395bc4841f886d8ba57d5f2682e2ce9907f0
SSDEEP 384:6GNqxEQXeIOouxLXhTQHAO1pWOLdiE486HZgvwEqI5z3b/KgORZoWeMQqzRZmrX4:CiQ7PO1iDQ0jsw/8mNWK1au6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 99KB
SHA256 5dc90dd9754cb3bf58a6be52365e052dc91948b13af1116549da5260db6c1fbf
MD5 914eae261cf5f39625805bed68f51621
SHA1 a89e155ba91f803fec1ba573b4e59c5df9cb5729
SHA512 b878b23afb6c821cabfc64f5f26d8ef73b02cc94d4f2f304e3614aaee3d9d52e00c96a51165a6dfe26a1b0164a5b19cd693bd101cfc1d12a127d59bf4c1fc7a0
SSDEEP 384:8GNqxEQXeIOouxLXhTQHAO1pWOLdiEPV86HZgvwEqIAbz3bDYKgORZoWeMQqzRZ2:giQ7PO6iDQ0jjw21mNWK1aua
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe584f34.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe584f34.TMP
Size 90KB
SHA256 4bcd6f49908a3c8f6d8653b4b9e75e393ba99f6a0a027e647367356cca0124a8
MD5 25f50d574ce6406da6f1114466942082
SHA1 e74bac8e2a2d0cd60bf3b65f98fa84b2884c7d36
SHA512 c1977de264bb0ee5765b7e802ce5a7b3fae670759aa69284779731926c467c15c6be7ab24d8d7cbdfcc3d7ca570ecd43d27f092e236a5ba85ddfd1a96b9e8942
SSDEEP 384:DGNqxEQXeIOouxLXhTQHAO1pWOLdiE4DHZgvwEqI5z3b/KgOReWeMQqzRZmrX8qj:XiQ7POviDQ0jsw/8mNWK1auT
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kqdoq520.default-release\activity-stream.discovery_stream.json.tmp
Size 23KB
SHA256 f4e6a62cc402c9c4ac76c396d93b59cd7a96951fa9c6998d1fda407fb88d8279
MD5 47d1743953419264a097e8bf0385e815
SHA1 b35b63b48236335f4088ad5f1a4ea71f93c70585
SHA512 b811763e894ffd45ae9deafec907c1b74e23202732e67d907e4e0f7cef4bfc6ad722ea3481fd91cb1dda2aa1e5a8f23a9972018fdb03e04f43e3d93caea4e5aa
SSDEEP 384:r1anCGlN9ER6LXsdRfPqUCyu4FehRU4One3M1UuUy1U/yaa:r17GlN9S6LiqUgSUuUf/y1
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kqdoq520.default-release\activity-stream.discovery_stream.json.tmp
Size 23KB
SHA256 1cae70c131836b0ec1b12fc7aacc4d358df16e4a947f83a374450baf9cc9dc4a
MD5 644a32436ced2c8c513147eb39fbb96d
SHA1 f9a4817d3ff79665ccfb9e0d19839ebdc955391c
SHA512 1ff59cb638be9314420d7f6da7024946895af1c6a792803f6d2e0c3efd4e54e4bd9e54441560c0f6cdaa67c3d1605d6c7270b090bdaf519f08154995e19dad01
SSDEEP 384:rQLhLfPqMM1UuU9OneKId0IqGlN6X6ER6SFVyuPCnWbgHnDyaa:rQZqdUuU9a4lN6KS66Cn8gjy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kqdoq520.default-release\prefs-1.js
Size 6KB
SHA256 18fb10ab38182b413816fed6a6d8bd77bf5879762ded1afb0c0ad4d2956d0c96
MD5 f32c12c40838880c0b29958f5b6fa0c4
SHA1 b598a779d526ff4e7124f46d09d3e6bf0c7ed51f
SHA512 f687bc437460b22b272f56ee2a01fed81b1379b8741cd16924d4b27876cdf52d80759ffa143299295968e123459c3b611dd1599c29f21c381b8d5ce39c196b54
SSDEEP 96:xHL5nUTU3qGq5fvq5LHzSq0XlnBOjg3I2HzsGuTBw8HcL0cORSo:x5nKR5fvq9n0XbL3IYzhuTBw8HcLSRSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kqdoq520.default-release\prefs.js
Size 6KB
SHA256 071a09b3d1a2903681d099183940b0d34e4413e1a479f5eac49a4c970ada68c5
MD5 9bd42004d6f2f7aaa60bf62d61689a0b
SHA1 1f2573eecb6f8deaceef755c1bbabf03bd6a1b66
SHA512 661166debafce722088e468293ec7faa3cc6e2952e5edbcba78b45997f05269464a60720e389a838d854cf6508a5d2b2ef5721a2c9757e3032f9ff3ec5dae9cc
SSDEEP 96:xHL5nUTU3qGq5fviaLHzS60XlnBOj/3I2HzsGuTBw8VcL0coSo:x5nKR5fviKf0XbE3IYzhuTBw8VcLcSo
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kqdoq520.default-release\sessionCheckpoints.json.tmp
Size 288B
SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
MD5 948a7403e323297c6bb8a5c791b42866
SHA1 88a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA512 17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kqdoq520.default-release\sessionstore.jsonlz4
Size 905B
SHA256 38374230b6f758de3265e3bcba01a3df4aaff823342165f3206c80162dc4baa8
MD5 eac1ef36eb5016ca7215db4c9d3b937e
SHA1 50d587fb2f4e6ae035d9e4da791ea3068a1d8991
SHA512 6317eb1b7dab3e5b7bee5343cd79c5bac24ed99eeffbae60868204c36e604cf85515805047d7a3c8feaeaeb52f5d0a933782a08466b133c02e432a4d7c2f3c2f
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 b862d153c5fe9106983a79821c87ab071bf9a7c2492ca378764533cd05784815
MD5 888ceac60d45c11a1a8da876c3555247
SHA1 e286dd46646036fbe529a4fed2ceff41f8f00e3f
SHA512 daa02e6ae8fd9c17b25b93bfd5eec539a6bbc081dbbb0a5507dc9f0019838e83974f9b1b55981318af3c5e3445c3e754cb16a1a83f57e2cbf3115c34f1f3f34b
SSDEEP 49152:yvFt62XlaSFNWPjljiFa2RoUYIiTIcEiOTk/fLoGd0THHB72eh2NT:yv362XlaSFNWPjljiFXRoUYIeIC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1836-11-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Download

memory/1836-14-0x00007FF974420000-0x00007FF974EE1000-memory.dmp

Download

memory/1836-12-0x000000001C9B0000-0x000000001CA00000-memory.dmp

Download

memory/1836-13-0x000000001CAC0000-0x000000001CB72000-memory.dmp

Download

memory/1836-10-0x00007FF974420000-0x00007FF974EE1000-memory.dmp

Download

memory/1836-15-0x000000001BCA0000-0x000000001BCB0000-memory.dmp

Download

memory/3120-0-0x0000000000E30000-0x0000000001154000-memory.dmp

Download

memory/3120-9-0x00007FF974420000-0x00007FF974EE1000-memory.dmp

Download

memory/3120-2-0x0000000001A80000-0x0000000001A90000-memory.dmp

Download

memory/3120-1-0x00007FF974420000-0x00007FF974EE1000-memory.dmp

Download