Analysis
-
max time kernel
1050s -
max time network
1046s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 23:53
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
orcus
209.25.141.181:40489
690c4574d03b45e4b89aa16b415b7baf
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programdata%\Chrome\Plugins\chromedriver.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
svchost
-
watchdog_path
AppData\svchost.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5240-859-0x0000000000CD0000-0x0000000000DBC000-memory.dmp orcus -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BlitzedGrabberX96 Installer.exechromedriver.exechromedriver.exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation BlitzedGrabberX96 Installer.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation chromedriver.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation chromedriver.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 22 IoCs
Processes:
7z2301-x64.exe7zG.exeBlitzedGrabberX96 Installer.exeBlitzedGrabberX96 Install.exeUnityCrashHandler.EXEchromedriver.exeWindowsInput.exeWindowsInput.exeKyanite.exechromedriver.exechromedriver.exesvchost.exesvchost.exechromedriver.exedotNetFx35setup.exedotNetFx35setup.exedotNetFx35setup.exedotNetFx35setup.exedotNetFx35setup.exedotNetFx35setup.exechromedriver.exechromedriver.exepid process 2260 7z2301-x64.exe 2328 7zG.exe 6036 BlitzedGrabberX96 Installer.exe 3556 BlitzedGrabberX96 Install.exe 2984 UnityCrashHandler.EXE 2320 chromedriver.exe 3344 WindowsInput.exe 2292 WindowsInput.exe 4476 Kyanite.exe 5240 chromedriver.exe 2540 chromedriver.exe 1472 svchost.exe 2624 svchost.exe 116 chromedriver.exe 1936 dotNetFx35setup.exe 1812 dotNetFx35setup.exe 4936 dotNetFx35setup.exe 5124 dotNetFx35setup.exe 1972 dotNetFx35setup.exe 3540 dotNetFx35setup.exe 5328 chromedriver.exe 5036 chromedriver.exe -
Loads dropped DLL 25 IoCs
Processes:
7zG.exeBlitzedGrabberX96 Install.exeKyanite.exepid process 3508 2328 7zG.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 4476 Kyanite.exe 3508 -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Program Files\BlitzedGrabberX96\Guna.UI2.dll agile_net behavioral1/memory/4476-826-0x0000000006250000-0x0000000006442000-memory.dmp agile_net -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
7z2301-x64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2301-x64.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
UnityCrashHandler.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" UnityCrashHandler.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
chromedriver.exedescription ioc process File created C:\Windows\assembly\Desktop.ini chromedriver.exe File opened for modification C:\Windows\assembly\Desktop.ini chromedriver.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 118 raw.githubusercontent.com 119 raw.githubusercontent.com 157 discord.com 158 discord.com 160 discord.com 161 discord.com -
Drops file in System32 directory 3 IoCs
Processes:
chromedriver.exeWindowsInput.exedescription ioc process File created C:\Windows\SysWOW64\WindowsInput.exe chromedriver.exe File created C:\Windows\SysWOW64\WindowsInput.exe.config chromedriver.exe File created C:\Windows\SysWOW64\WindowsInput.InstallState WindowsInput.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7z2301-x64.exeBlitzedGrabberX96 Install.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7z2301-x64.exe File created C:\Program Files\BlitzedGrabberX96\Kyanite.exe BlitzedGrabberX96 Install.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 7z2301-x64.exe File created C:\Program Files\BlitzedGrabberX96\APIFOR.DLL BlitzedGrabberX96 Install.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2301-x64.exe File created C:\Program Files\BlitzedGrabberX96\Login Theme.dll BlitzedGrabberX96 Install.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2301-x64.exe File created C:\Program Files\BlitzedGrabberX96\Guna.UI.dll BlitzedGrabberX96 Install.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\License.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2301-x64.exe File created C:\Program Files\BlitzedGrabberX96\Bunifu_UI_v1.5.3.dll BlitzedGrabberX96 Install.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2301-x64.exe -
Drops file in Windows directory 3 IoCs
Processes:
chromedriver.exedescription ioc process File opened for modification C:\Windows\assembly chromedriver.exe File created C:\Windows\assembly\Desktop.ini chromedriver.exe File opened for modification C:\Windows\assembly\Desktop.ini chromedriver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exefirefox.exefirefox.exefirefox.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133595134517857936" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 22 IoCs
Processes:
7z2301-x64.exefirefox.exefirefox.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2301-x64.exe -
NTFS ADS 2 IoCs
Processes:
firefox.exemsedge.exedescription ioc process File created C:\Users\Admin\Downloads\dotNetFx35setup.exe:Zone.Identifier firefox.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 954318.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepowershell.exesvchost.exechromedriver.exepid process 2600 msedge.exe 2600 msedge.exe 3700 msedge.exe 3700 msedge.exe 4092 identity_helper.exe 4092 identity_helper.exe 4484 msedge.exe 4484 msedge.exe 6080 msedge.exe 6080 msedge.exe 1808 powershell.exe 1808 powershell.exe 2624 svchost.exe 2624 svchost.exe 5240 chromedriver.exe 5240 chromedriver.exe 2624 svchost.exe 2624 svchost.exe 5240 chromedriver.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe 2624 svchost.exe 5240 chromedriver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
chromedriver.exepid process 5240 chromedriver.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
Processes:
msedge.exechrome.exepid process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
7zG.exepowershell.exeKyanite.exechromedriver.exesvchost.exesvchost.exechrome.exefirefox.exefirefox.exedescription pid process Token: SeRestorePrivilege 2328 7zG.exe Token: 35 2328 7zG.exe Token: SeSecurityPrivilege 2328 7zG.exe Token: SeSecurityPrivilege 2328 7zG.exe Token: SeDebugPrivilege 1808 powershell.exe Token: SeDebugPrivilege 4476 Kyanite.exe Token: SeDebugPrivilege 5240 chromedriver.exe Token: SeDebugPrivilege 1472 svchost.exe Token: SeDebugPrivilege 2624 svchost.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeShutdownPrivilege 4480 chrome.exe Token: SeCreatePagefilePrivilege 4480 chrome.exe Token: SeDebugPrivilege 1808 firefox.exe Token: SeDebugPrivilege 1808 firefox.exe Token: SeDebugPrivilege 4248 firefox.exe Token: SeDebugPrivilege 4248 firefox.exe Token: SeDebugPrivilege 4248 firefox.exe Token: SeDebugPrivilege 4248 firefox.exe Token: SeDebugPrivilege 4248 firefox.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exe7zG.exechrome.exepid process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 2328 7zG.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exechrome.exefirefox.exepid process 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 3700 msedge.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 4480 chrome.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe 1808 firefox.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
7z2301-x64.exeBlitzedGrabberX96 Install.exeKyanite.exechromedriver.exefirefox.exefirefox.exepid process 2260 7z2301-x64.exe 3556 BlitzedGrabberX96 Install.exe 3556 BlitzedGrabberX96 Install.exe 4476 Kyanite.exe 4476 Kyanite.exe 5240 chromedriver.exe 1808 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe 4248 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3700 wrote to memory of 1544 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 1544 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 3280 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2600 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2600 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe PID 3700 wrote to memory of 2804 3700 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/BlitzedOfficial/BlitzedGrabberX96NEON1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa67c946f8,0x7ffa67c94708,0x7ffa67c947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5232 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3440 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5380 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,6590866919591889367,1671860042301954309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\7z2301-x64.exe"C:\Users\Admin\Downloads\7z2301-x64.exe"2⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BlitzedGrabberX96\" -spe -an -ai#7zMap10949:96:7zEvent317591⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\BlitzedGrabberX96\BlitzedGrabberX96 Installer.exe"C:\Users\Admin\Downloads\BlitzedGrabberX96\BlitzedGrabberX96 Installer.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exe"C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXE"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File poo.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\chromedriver.exe"C:\Users\Admin\AppData\Local\Temp\chromedriver.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ixyvcef2.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC43.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDC42.tmp"4⤵
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe" --install3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\ProgramData\Chrome\Plugins\chromedriver.exe"C:\ProgramData\Chrome\Plugins\chromedriver.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /launchSelfAndExit "C:\ProgramData\Chrome\Plugins\chromedriver.exe" 5240 /protectFile4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /watchProcess "C:\ProgramData\Chrome\Plugins\chromedriver.exe" 5240 "/protectFile"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsInput.exe"C:\Windows\SysWOW64\WindowsInput.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\BlitzedGrabberX96\Kyanite.exe"C:\Program Files\BlitzedGrabberX96\Kyanite.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ceqeuzcp\ceqeuzcp.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2gpvgfii\2gpvgfii.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dtxvv5cu\dtxvv5cu.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wmqor5fq\wmqor5fq.cmdline"2⤵
-
C:\ProgramData\Chrome\Plugins\chromedriver.exeC:\ProgramData\Chrome\Plugins\chromedriver.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x11c,0x120,0x124,0xf4,0x128,0x7ffa5886cc40,0x7ffa5886cc4c,0x7ffa5886cc582⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1904 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2204 /prefetch:32⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3144 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3364,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3384 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4552 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4744,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4696 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4840,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4664 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4988,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4996 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4480,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4820 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4660,i,8688453934348414403,10188995631406317992,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4048 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 25457 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5591af5-f90e-40cc-8537-f49aebc3dd14} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 25493 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7618e98f-7320-41aa-8651-5e61f54288ad} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" socket3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3320 -childID 1 -isForBrowser -prefsHandle 1400 -prefMapHandle 3284 -prefsLen 25634 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1d88746-be20-48ca-8cb1-cf7d3c9cfaf7} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4292 -childID 2 -isForBrowser -prefsHandle 4284 -prefMapHandle 4280 -prefsLen 30867 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d277206f-a046-40b5-91f6-5c0650c11885} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4936 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4928 -prefMapHandle 4920 -prefsLen 30998 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43012df8-4e46-4d63-8425-0932a6e95eaa} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" utility3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5244 -childID 3 -isForBrowser -prefsHandle 5236 -prefMapHandle 5232 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {089a9f31-ba58-41a2-8e4a-bd3507f28c5a} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 4 -isForBrowser -prefsHandle 5460 -prefMapHandle 5456 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fadf2c13-90f8-477d-9842-653df55e5978} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 5 -isForBrowser -prefsHandle 5604 -prefMapHandle 5612 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1364 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2344e526-74cf-4993-b1a8-15545b7126bb} 1808 "\\.\pipe\gecko-crash-server-pipe.1808" tab3⤵
-
C:\ProgramData\Chrome\Plugins\chromedriver.exeC:\ProgramData\Chrome\Plugins\chromedriver.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 25481 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59c5448d-72d4-4907-95d8-4bb613bdac44} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 25517 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff67ce27-a669-485a-95ad-b7b4c5a0b869} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" socket3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1604 -childID 1 -isForBrowser -prefsHandle 2900 -prefMapHandle 2772 -prefsLen 25658 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e05af8f-2488-4859-80c9-a90665adc445} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 3720 -prefsLen 30891 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0912112-5182-430b-81c0-69e929615162} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4760 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4616 -prefMapHandle 1592 -prefsLen 30945 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84043f76-3971-4774-93a5-8531d61b93e4} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" utility3⤵
- Checks processor information in registry
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5172 -childID 3 -isForBrowser -prefsHandle 5160 -prefMapHandle 5136 -prefsLen 27044 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d03e1c6-92c1-43f3-9529-6f6ae5bb7d10} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 4 -isForBrowser -prefsHandle 5312 -prefMapHandle 5316 -prefsLen 27044 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62d1c6d4-798b-4a96-8073-fc87d1d791f5} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 5 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 27044 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbcb43cf-95d6-42a8-b978-e3b8437e0846} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6016 -childID 6 -isForBrowser -prefsHandle 2320 -prefMapHandle 6008 -prefsLen 27044 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ab0b56e-ed5b-4bec-8c85-a58b08979776} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5208 -childID 7 -isForBrowser -prefsHandle 5908 -prefMapHandle 5192 -prefsLen 27910 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8dec277-1784-4c93-8ba7-2fa57360af9d} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6568 -childID 8 -isForBrowser -prefsHandle 6528 -prefMapHandle 6548 -prefsLen 27910 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {489fa744-4a89-4692-932f-3003d298f434} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3028 -childID 9 -isForBrowser -prefsHandle 5272 -prefMapHandle 3096 -prefsLen 27910 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e37db436-996e-4e39-b2a5-cd86a1c3e8ac} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6092 -childID 10 -isForBrowser -prefsHandle 4676 -prefMapHandle 5180 -prefsLen 27910 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc1c4559-2b7b-44a3-9125-7be155551358} 4248 "\\.\pipe\gecko-crash-server-pipe.4248" tab3⤵
-
C:\Users\Admin\Downloads\dotNetFx35setup.exe"C:\Users\Admin\Downloads\dotNetFx35setup.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\dotNetFx35setup.exe"C:\Users\Admin\Downloads\dotNetFx35setup.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\dotNetFx35setup.exe"C:\Users\Admin\Downloads\dotNetFx35setup.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\dotNetFx35setup.exe"C:\Users\Admin\Downloads\dotNetFx35setup.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\dotNetFx35setup.exe"C:\Users\Admin\Downloads\dotNetFx35setup.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\dotNetFx35setup.exe"C:\Users\Admin\Downloads\dotNetFx35setup.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Chrome\Plugins\chromedriver.exeC:\ProgramData\Chrome\Plugins\chromedriver.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\Chrome\Plugins\chromedriver.exeC:\ProgramData\Chrome\Plugins\chromedriver.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7-zip.dllFilesize
99KB
MD5956d826f03d88c0b5482002bb7a83412
SHA1560658185c225d1bd274b6a18372fd7de5f336af
SHA256f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d
SHA5126503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647
-
C:\Program Files\7-Zip\7z.dllFilesize
1.8MB
MD54e35a902ca8ed1c3d4551b1a470c4655
SHA1ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c
SHA25677222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9
SHA512c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30
-
C:\Program Files\7-Zip\7zG.exeFilesize
684KB
MD550f289df0c19484e970849aac4e6f977
SHA13dc77c8830836ab844975eb002149b66da2e10be
SHA256b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
SHA512877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
-
C:\Program Files\BlitzedGrabberX96\APIFOR.DLLFilesize
13KB
MD591b4d211faddb0ebc64fb000d75d96c1
SHA1ba496c122f8e562ff0a4fb272a68f0b9e7bf0a3c
SHA256e47ab6fb21bd8943f63d79387533abac0c2bd98245546df44c4f333d8013c4de
SHA5123f16b0b4618d446d0e42ed2063c611b4ffa72a5b0ff438df5286a216167881737e65d494aa12186e511690eaca2f51c00889c9eae5ab6392c1edf885e5592919
-
C:\Program Files\BlitzedGrabberX96\Bunifu_UI_v1.5.3.dllFilesize
323KB
MD5e0ef2817ee5a7c8cd1eb837195768bd2
SHA1426ea1e201c7d3dc3fadce976536edce4cd51bce
SHA25676e1d3ec95fdef74abaf90392dd6f4aa5e344922abf11e572707287d467f2930
SHA5125ad95dd7f0e712d543acfe7fd4539695f7e894988c0a2c44231c43e5ee29e743cb1ffe6bdf1fbdbdcfd3aa374f036113bcc6a1befd0114954093520bac47234c
-
C:\Program Files\BlitzedGrabberX96\Guna.UI.dllFilesize
876KB
MD56d6a1f28978d42ad2f0a8f278eaac966
SHA1b09168ec88109422ca29cf4f1b6462d51930873d
SHA256fb23fa4fca8f28bebe7b7e39593a211cd3c3405de5f948ec520e859b1bcaf91e
SHA51276ddf88255a9355fc3c781880e23d94206acca4decf5623712411f7a733e91ca9ea37944860401cf9667f10e8c33a087803a4726f91faff1f23e3e0592ddf41d
-
C:\Program Files\BlitzedGrabberX96\Guna.UI2.dllFilesize
1.9MB
MD50f07705bd42d86d77dab085c42775244
SHA17e4b5c367183f4753a8d610e353c458c3def3888
SHA256cf9b66e11506fa431849350c0cb58430a71e5ec943d2db9ef1b2e2302f299443
SHA512851b1a4c470ee7fe07ce5619c16fd391428585926c5b559694a9e445633ea51ec86c74a3bbf3bce39d943c4bf714dad2fd3c4a4d0703be2333541c79a2ee97f0
-
C:\Program Files\BlitzedGrabberX96\Kyanite.exeFilesize
822KB
MD57cebe29a86c8bad15bbf7f190ae9c012
SHA1a035287675af874872753aa813c2e17f712e2ff5
SHA256808226fbf400593c702b5efe774290f0d2787d2a3fb25d0359cb3ca72a9b2b44
SHA512add343a62e77af49870386a3d5f8976ab53bdc2b2d7820ce735238db806b95e06e111a99114b8ea5c0dd74ee38a58466a79255705c3b3b0a7746eea4beabedbe
-
C:\Program Files\BlitzedGrabberX96\Kyanite.exe.configFilesize
189B
MD59dbad5517b46f41dbb0d8780b20ab87e
SHA1ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
SHA25647e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
SHA51243825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
-
C:\Program Files\BlitzedGrabberX96\Login Theme.dllFilesize
102KB
MD534b9583b485e101ebbd9fd100699eab0
SHA163a8ed0e336f7ade8664c8ecff81eb473f9d4d05
SHA2568879dcfb480f0b3c47414eef8ec50d57f13c6c0895644000b17a38e465896d7a
SHA512467dea806fb1746a8eae12cf2d7cc7029a0a237790904c49fe22d809cfc582a81537bd6cb4c0fe1a34bce259bf20609924a0cc62b5335ed6d279ee26c1baa30e
-
C:\Program Files\BlitzedGrabberX96\Siticone.UI.dllFilesize
1.6MB
MD5ea797152ded4478107c08a9c9c28b454
SHA1f28104d7099cca08ab84bf1ad1acb9233cbf116f
SHA256c435f969a0150ec46e8f2414615e7cb1670322650fb632443ac9f0a146a98c14
SHA51265d7a52243f46be4a5a4e82b0b5771be17efc7404411df9aaf95ecb4450699a5989fbed2f160b1ae917d04f6f3d71f172ad4bdaf238e37300780a781d13450ed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsStateFilesize
649B
MD51288d1d5aa2847e0a44802540980a510
SHA1bd632cdd9a1fe265f039ff2f4c68bdd6c15327fc
SHA256bbec80ae95178981720cea2c3de90899c51d788b25c637e4eb13e5604a9ab2ea
SHA512631999ca158c6aab1d9302ed3572ff1efe9d555c560eb67693c448e4b3fca0a540dc32a84f39a5ac1023162cd492bf46fc434e82b48c868ebb2aa03f4bb170f1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5a8b88a87f3871cccdfad6d8edaa2f4c9
SHA141164f97411c41b2ca3b8f34f5d67024f15b62e8
SHA256b15521e6c3a64bd64862503ec75ab9ac63f0748adfad24cba3b8f92a5e358d00
SHA512a05282795c6320f22431b2b12bef884969824088f6b44233a08b21b47a9a9d81dd22d89a60092dc2c054a21a17523e6d9512776aeca926cf6e7d82898875da35
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
523B
MD519388473c393f74effdfc69a446339b5
SHA1f8502aab89cf09588dc6f583d9ad8233f136542d
SHA256e07182947e869bd087413a788f554214dd0ec49050ecb58a16ec6e49beedab0a
SHA5123116b5d45ca35c61c8ceb230f99602126bc0c1475982d3c05a12ddaeff5488bfc23604ca91d9c3f88a2679d924b673aef072aa574a47873fc9a63d417901aac0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5daae85afbbf9d1bc3b117e143d067b81
SHA18ab0544c83843220ce361c00a2f467a95ce74a10
SHA256b49145a5bf81ba376c03165636ee382c7b1a9deb745708a1f06b2d08751f745d
SHA512348d6b253173a505751790f948fae9fa58f9d878e6172edd4148d0092a02e0f9c6f45671d90895bf09670ff0be1508e176b8778afce787d0611df4fc00390552
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD50c27dbf38b28c0870b74876209e0fc97
SHA1768cddbeeaf4d7014963d347cdda8dafcab46fee
SHA25670c6b9e6dd42923a5e85abe74caeb31d7d1b41b82361aa8c9eff1f2c66f19e6b
SHA512ff6f8b940bdd11a62b4493223d6d94a7c43a74330d140abb35719f4f8ed2a203ea11a39f7672af649c241fbd77fd7a405da0a6a3513222862881eb0ef64da5c5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
152KB
MD5684fb48f581fd4fada5ed561a3372f21
SHA15afe12beca1479544e08cb55218df16d844ebdb6
SHA25612d0105c443f9795bf1537bbf70074e7581c1d25c668d0fa968c90a1ff5b8d5b
SHA5129d1b2e06fde507f056a0ab23703f756db24f844cbd5e74d2b6745f4a3c2939c6eae7f60a195f0c3cdceada322233a215d568bc548ae0268a3bc700bdd114ee20
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\afa25c33-0ceb-496e-9413-10e1cc468626.tmpFilesize
152KB
MD523605f2c67706d65a6acc29fae82228f
SHA19ebf24e9c26662f47aa2dc5445fc558852d06efc
SHA256d8d67e23fcb60d267bda56f53fb8200143a55726dcf74e4096b760d85fc2f3ce
SHA51295d7d7e5d1eb92b40277ff71a72e484a2f7be7ead745859c1b861fe74ab814bb2a6dd099f68d5a7bc90e1643b620b68e90d85104fa58bb120425a157ba3b5e6b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD562c02dda2bf22d702a9b3a1c547c5f6a
SHA18f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA256cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
SHA512a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD56745efc163aac1cfcf21e46b218a6b0b
SHA141726287cc45a3781ca7a39dbdbd62106e36116c
SHA2566a25253adc992320dd1de0469847606c922cbadd559ec4544e4e6e5d2331e699
SHA512a1f1c5b3fb2bdd01793fd988de49f2d6cef3feefe9bb6bfa5139f0a3efce15bca4283ad21e0f82b76cfe404a97f10f2a38591086515229167fec832ece29057e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
665B
MD56909a87cb59e8565c92b915f718a2939
SHA152f8a5a6362c4d636d4c3f4b2e9cc72240d6c6c4
SHA256fcc668372e58cd109b2dbdd6e68af68a61daa3940692e40e43991bf7d3f7be60
SHA51231d5848948fecf5f960f13dbdfa14bb6007f123360cf7cb5454c0c829e836a7a513cd953c2902ebabae997980328e9dce66a3aaf7477f104108b7b4c96e75678
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5ab8aaa7c8d3bbbd29111af9bb89636f8
SHA1a3e4715c1e5f84c699cea353d0575302ec8c66d4
SHA25603ec036869fdbeab99387a4b1f8866cba00ac7964a1612f926b094d68467edc8
SHA512a1df7aadeb4723f4fddb1a198cb16c5f038931b6ecc484f8e987ed7e86c7c31c483807b53c75136a3cc8a1d0742fae3f10282d051d2ea84f9a1993163d5045dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57c81d4b7c0fa2b5d992f909ce63473dd
SHA173c62fe24713e55e151d65d7159d512d89136591
SHA256b1518cd6a2c658041594693248185e8bbc7e4fc4417fa9e9c8574c6f8cce1da4
SHA51291c6b749438ee7e5c00ec0f5757452b851fd6ee76b4183bc8b826ac4f9156de96fea269425ab53200dade7214c752db4e19f4b63f1a82d1ea20816949ecb91e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5661eb10ef536801e45a0c089ac12536d
SHA12f00957b84357aa018a54caabd7c68cb44e0ce9e
SHA256eba5d14dd360afc0e0aaa641bba7e76b209acf67995c21d8312f4d4c4522901c
SHA5124f1cb49e0dec616b3ef59e663474eeb7752bfadeb48f2a155608c9f140ee152ff2b2db59bae0979465af2ed3490b51c349b40f7ea8a75bc9a9d01c662866cd05
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52c56ccc88e2f5a1ad86d2787725d4994
SHA17f97866f36f589a2ed9aa8ef2cc637e0922f19a6
SHA2567c07ce30bae2e6bc7d6f0ccd4c549ccd87191d4816c859fcb22915f4f80f30b1
SHA512bf0a74455d9721d0bffbc36e18fcb53deb8481ec69c7383040c9fd64760b5d4bdb5288b6abc42b73a12f320c5eaa16481635ed40c664903626e5626e31181bd7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5866e8cb9f221dd31a233108cbfaebc7d
SHA1c58e7d8137f66e11420b0ecbf1f2b5a62bfda088
SHA256f590052f7bbbbc50b88193e7396f5e82b4317332c706f2a01495f84ef6e49bf4
SHA51254755a943e877e57341c16cd2ae43f8b2725cb6b632f28f81239ea7d24e4f28f8e98577bba5530ae26c4de2d7d4298efc851ec56908ae1bf88a990701dd39550
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5cbfa3448f76ff1c88ff9b1e31c1fec5d
SHA1221bb23f7f481052492893c6b740c103d515d424
SHA25693b742d4b2005fd427f46f9e25e0aec1be3bc762d6ff1cc467fedafc9811bcc2
SHA5120e779026e5c698a77e6f295f1e31ed1c14e7e462990c56da6cf9ceb8b4b6b518630e6826799728560d9aa9a74c1c85c59b3e35801c54cc7856421474841ed1d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD59d9f2f56af99d988849239e351adccd2
SHA15176510a5f479e0c4e44e5ae5c89181ee07c233c
SHA256200091abe7c9e977e768e6f77180ae5c5e63b74e301bbbabf64566526a30844b
SHA51242af5ab300f05b8238617dddd94e4d14a5c5924f18f8c89d7485f37f6375509270ca5621bc433e4d435aba8c5757b83bd87925f95dc77d49bf0d197c828f9030
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD57f0c8cfd9eb6fd503e6685e77303b641
SHA1a197d85904874b5fac4b55a4a702790b38634726
SHA25652adbe34d7c378c548998b6186b1e9d1788f3c05bd122a46ccf41539bb010579
SHA512232a08114afef73e43ded40c7d6da03942634b6c4d849d6e0d880136ce81532dc8121745564d477f30a11ab1034864335c2ec46d81d3e9997bcc2718ba6a4ed4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a6df.TMPFilesize
1KB
MD5b7b7a331e612cbfe5b9ac69aa94cd856
SHA1871710137881b5e7e44e2b92a13000e9540e0a8a
SHA256080b2e5162908f02e5d6aa8ab107fb2c71193306956ce6f92b91432fdab3dbac
SHA5127f836df2270effaae868d0714b9bdf32ed4f65981ddc93157d8849e11cb82bb71134777838d97dd5e444e2eb79f9af519af1841f3ae68fe8d663b527513098e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD59583948503da7dd48236a87e102da0ee
SHA1b12f213b460c305348b29770a5918dbaed8d26f5
SHA256505d7c2454b06134b89fb3fe414772cd99bc381e29979537a3c9cc8f71056b62
SHA512737a7757aa57be1fb67eee437e66172828b4c5c7b48cd81f533d5454761c9ea433463c47793a73262a2f70c3521fd96343171ada21071d2d918981566256727a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD511ebb8b87da330317322302943108d5f
SHA1a857ce840c917814b4318ce27f0f528824d17b2c
SHA256a1c64c6fa91fd9a544a8212ca653a865320a1544d3ed0e918e5cdd8fac7268f4
SHA512f1432a7de390a67a0be8ae6510b3bf7b4f424a1f7cb024e77432f3ed13fd0cab791935dbd0dbcbe56cf0fba6646c873663bfc1dbd04982974697ecf12d99279f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD557a2c47994324ad0db46556d6e28fa5c
SHA1ae9f11f53ec75695f00e8e3010172e759d370cd1
SHA25693dbf449b69ecb6a8488d2ec378660feb3e81a3435d9321b6654a1ee501e2691
SHA512aaac426d066eb49a2b6be898ddd4f9779332856ab3408e6be23631b1722b4d166d0e5f353ece1e2b2b8aa28b32f953e0e165ca7164fc999163ee39ae15672958
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\md1ejlmw.default-release\activity-stream.discovery_stream.jsonFilesize
22KB
MD5f1757c2d32bfc97d2cdb4d4cf0836630
SHA11f141aa3f1cd280d4577dda342c2b4ab80e86f9b
SHA256f21044d061f326b6d68afd455c8fdc62a9c61cc0dfa23e58e104af68d173aa8d
SHA512a87cdfa18ea21ea89a9bf9433e2a57dfacc92f2c8714adb936f2c6907a357fe72ef661e07748e5b9e470131c38a9c950f673e0577fed40878cda18add41f16e6
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\md1ejlmw.default-release\cache2\entries\3E60B1F6F25CFE891C65390EF158CF1420907CD8Filesize
60KB
MD505948a246f4a25417b531addbf8ad2f5
SHA1f1e640bddf58faa393c1a4ddf57c327c29c6f433
SHA256d3f7b80309b84cd9aa4509d89dc6d6ea7b12d225ce38cc39d35c6825358ce106
SHA5129d4c6ca5b3c4583db99e879b5ebebd995f1467c2daabd7068a2c6fb22968d2bdca7d218d5921824fbebe769153978cd4dd9fd3ccd336b55cfa221eda155a95fb
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\md1ejlmw.default-release\startupCache\webext.sc.lz4Filesize
107KB
MD5e497bd38192c24e39720a7cc2a015811
SHA1a66fbb6620fb2b2abc5a5b13ebe690aff0a08cfa
SHA256a12f3c3b2495d1751a69f89181358910fd3c50992ef196cf9e0ec9cb6cc7df8b
SHA512d4aa83c18342e10876b4b8a746dbe92f09e2f5a8300f940de44a3fb3022e6d07a73bea0caabc80e1355148459fb3d1d9f03b22316efb882b9ef75cb2772e338a
-
C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberX96 Install.exeFilesize
2.8MB
MD546d8dfadf7f9d90385ab7df71b5adce3
SHA199482121b86c790a6f2d732b0a47a1e41922518f
SHA2567fc18666d83d233def6dd05b7c46851e65753a7e8ab3bc6c76141ed5c0ab7d7c
SHA5122e133aac3c749a285f5bad25ee34776065607053cff04b84bafa0f01da9409f082de624e6bd422834ce55fbb87c4effa7f84a26766ad961bb73f9b967e1a4dc5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\poo.ps1Filesize
35B
MD55d792fc7c4e2fd3eb595fce4883dcb2d
SHA1ee2a88f769ad746f119e144bd06832cb55ef1e0f
SHA25641eccaa8649345b33e57f5d494429276e9f2eb23ca981f018da33a34aabfd8eb
SHA5124b85fe8205c705914867227c97aa1333421970d8e6f11b2ac6be8e95fef1a0f31f985547eafe52e382f13c2a16afa05462bd614b75bee250464c50734d59a92e
-
C:\Users\Admin\AppData\Local\Temp\RESDC43.tmpFilesize
1KB
MD5ea4f569600c4a36c9c3b47199ca5c097
SHA14d5824037031ef16e9bba08082abd8bac33246c6
SHA2566ddf195a22cfdb4125cd63729411a0787a30afbd0bdc4e4759ae680f164e05e4
SHA512d51ff7d62b2237d73c9274c2df168dc2b11b0860e7bebfa0c8997954cbdee8a75619639e147fd20abc6659b4cc997da2aafb6f547a26780e4e91a8af317fb91d
-
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler.EXEFilesize
155KB
MD569bef95f8029651ff546b59544d3d6cd
SHA1a8cf6d690064e6bdeeb4d68f4f5180eb7c4bb8b9
SHA2560cb43f43e81730a4a92874911ac39420954174c7fd9b1faea8e891e9b814f8ac
SHA512b3a4ac7268307a453eb903d0bc75939c9ba05f0c121fcbda0340e037ee8c7a9af1f11b212dfc6e41dea870e2005fc6896430fe84bbe360e96f75b91f459b710e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_th2pnvyu.s35.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\dcfb00f9-5ae7-4197-ba59-e48107e40d35\GunaDotNetRT.dllFilesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
C:\Users\Admin\AppData\Local\Temp\ixyvcef2.dllFilesize
76KB
MD5ad48181001e0e32a8f7b17bfbb33d3f0
SHA16b8351081805deb37c6fe1436067541eb004802e
SHA2563c69a099e1c0e0285746cc5d66d8f6cea9d2f65ad05d8afefa6f47acef6113a5
SHA51285baaf571f20b514c212a1b5a4271b5dd5b94ce9b8954681352c8dffb579edebe9c9cfbae7e839055a80a018359bb38545fd49abed449339fde449fed27400f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddonFilesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\AlternateServices.binFilesize
7KB
MD55b8badd286fadb080fb6bcb3986dddc5
SHA1de8bfde78266990bb3cea55c80f3a214df1f5b6f
SHA256c0e6aea142ffc0daba6bcb86cef7a190198a0cb942efa8a555dea1d6088be188
SHA51296a4e715f43754eeb2dceadb4c8d5289f550cfd1505ee44ae049cd5d93d5e16e0b42cd4546b432a0c8dec17319cade47e67d81190a07dccde70ae51a2e16f07d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\db\data.safe.tmpFilesize
5KB
MD5abdfc20f592b44bf163b5c17bbfbaa9c
SHA1f10bc16cab8518ad6d5b0a17158a1cb4b85d5c47
SHA256d37989426e6124224d83f89dd0ae979c8cbe69e941006075704099605caa4df9
SHA51218ea52d1a7440afa875e4b867a1bda996aab933df2c16be28f4316cfe0abf60f059372317f37b5d1ebea633b906c0aab68464c71f2f028088c7032515c07be61
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\db\data.safe.tmpFilesize
6KB
MD57c9f91df582ea4d77b90008c556ae742
SHA19ced5ae78c6ff3ef5e594c34bcc7dd26e5ceaa1e
SHA256a642d25a444b0710a094b52a46045ff7fb384ce0edf8ce1eef19d926fe78b99c
SHA512a3354d411af4feae27d0101b64c84b1fcd1e18abcc0a5905060cd6468fcb32d87ef8b56d2b79741a009a16349ccd097f949bc98f8d10e0d056b7e64b61b40c86
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\db\data.safe.tmpFilesize
14KB
MD5a1796c90054b8b44bbc07de101e44275
SHA111e04c8adef41406d5b857bfa87444dc4206b39d
SHA2565fab1f0f9a58e2d7b0ac0a7be3ae93f0f65a6fb4a625a09e2c642c9db3c2a7e2
SHA512e1a8ad5afba4938bd4ea7ec7373c676b47fa6a9230ad621e648b87a1bad50549d6f8fea5b2ee26f938ecd8af8bc30fc07dd39527c47698ac6a34cc3fdf892366
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\db\data.safe.tmpFilesize
15KB
MD5a6783d0546a23ae61fc318ca2303f0a8
SHA1c84810ebe0c3b781e8005ae7a00e27db493fdcb2
SHA25695e46719dbe836be9a61fe764868908210b70f5f9b62fb43ef11b22655f870e0
SHA512a5c1b5a3a4b4b60db471dabbee18da1ec09116978131d9b6616a99ba78ad1e310eb1384e42cee028ddf8ca6fe792593c1c75ee3d2347b73383e1a89cf11c9619
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\db\data.safe.tmpFilesize
38KB
MD5bda1bfbef461cc4325917f7d6508a34c
SHA1d591c59ce47fb5283ad834da2f0501d599817510
SHA2569c0df0b50b05745f46e5614a84db0cd9c9739998c2d21298f2d34c0f86cc5513
SHA5128aebe37248b73ccb0e4a4ee8e3eceb651e9ebf13053fcdc30248736a764ff6ae96dd81b74e851724b8fb0132f5afae0955b1b9212da6f5093d8c3803d1cd8a11
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\pending_pings\020154ee-d9ee-442d-942e-6da10c0f5fcdFilesize
671B
MD5227d2f1fdc22fce627d6161757605a55
SHA14e034b4c7c1397024c98321801303534bbb6238e
SHA25672c65ae59254843bdfd7cfbd56ba83764bbdb362609f5212ca9a9a4c39c94116
SHA5121de3cb536402a616df92ff883843ea19aaf8f14afd48678a5d9a44c0add98c0947ce023a2593985adab568e5958b17c95e3609f7b499b7977126c144802892c1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\pending_pings\1e7398de-37ab-4b7d-83bc-00c52c14feddFilesize
905B
MD59124ca9be87db80cbdc919958221accf
SHA175ec610d86562cb5fd40f5b067d1e32ff81127bf
SHA256c1706d0774d00783790feffddd90eb88802ab910f126126aa96e604e5f50cf20
SHA51281cea1c9fcc7ad1a2dbaac0e916284a791f2e3943c55883eb65a6ef0c7ddce0d1b7ec35211ce1ee4b2d289f0e28a8301e7e9b3ec80d04a629f3cfcb47b0f2515
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\pending_pings\52449a7c-55d9-408a-a150-1647df21b529Filesize
26KB
MD508f91d0669f1c4dae4187243bef64087
SHA1b5b70cdbc96c3e84ff33b214f664f0db12f5adef
SHA2560cc55fe4f3a1d8e19740fd3a3ec6ce19aa7fc36dbe4c42c1fb771e61a21744a3
SHA51210a704b36cee14d496e42dea3830adddb14b9f740724ba33b4cfb97b04daac4d4e0cb067948a1c88a358e3115b09908646ce8bf3e0d4764498c55251cdd29d8f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\pending_pings\bd3b8818-4027-493f-94f2-3e6457205253Filesize
982B
MD53c9bd0e60b95ba17993650630e24499f
SHA1c5d869e10f185509e07f9bebd41a8d1d1473e228
SHA256ca5afda045adab27a36efc98134ffdf1e6cd8d494a3b3362e27086434cfec3c4
SHA512c2afda0d46b84d50b3960335d3aa6044fd38d525ff6d92bb4282db39fc077a07fdc5b810731cddbf7a79b3013610025e12317cb44768776f674fec7dd6fb0696
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\pending_pings\c23cd228-969c-4bd2-8dc3-46135a25eeafFilesize
659B
MD59a7841573c48dcc1169ad49b863ef560
SHA14cf2453697b2c6fa28e28a90c04c90e04b6a36f9
SHA2568e0ac60cdf716bf1779a39174ec6b516bc4f8b3f9147dad1abaa8da4b181a164
SHA512189af2ad23b8e9509a5c418a531cc3176d006ca3e26347c9817f0438192161f469f825908cba28e5f3dc7ef52936b763927c8cc6caf0c4e60b5ea09664382686
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\datareporting\glean\pending_pings\d229d2af-9e73-4240-b151-8fcebdd04a71Filesize
13KB
MD51bd07c0ebda427944376501601b4f60d
SHA13ac30ffdaeb5738d189aca9a75275c342a0a5c59
SHA25629f5d8b23e5d235c2cb1d37bb2ab26a8ae1750050bc4d22b49e2c8b5c9f1750a
SHA5126de6a5451155f1882ce3667fb5d332bcebcf6d484de6e70819832ed08ddbfcc39b560fedc1fcbb43d60141e5d6a615cf66471f0edcc4a644243283ffb47e09db
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dllFilesize
1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.infoFilesize
116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.jsonFilesize
372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dllFilesize
17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs-1.jsFilesize
9KB
MD5a4a58e189fb389ae601d9e012732dba6
SHA1bd96a5f06ba7846b3b1a4c3314688773433ed3e1
SHA256b346b05e23c19aaa16faabc093c3ae84f10c23e7556e8235c1c33f1e82e03235
SHA5129177defcad561cac3933d77afce36d19aabe1b77a9d2d0e407c58ed3c1a5711b86594ec918caf3ed63cd8ca5134406c7372c73f72a2a42bcfca303548c38125a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs-1.jsFilesize
8KB
MD5b12999458554145495ad2fc854ad7e40
SHA1f9ae454e9ab1513f35dda39c6631e2ad0b8ad859
SHA256dbdecbeddb5330b93037740817670f275b79348a0578c35f5f58af6e35192404
SHA5122f6864078f617e58013a392c9415a983ba39c1cd8c859fc4dc403e9a22f4791476d357a8e84951eb268bad5a5e463298645c87a72aa46037537ca65c8447932b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs-1.jsFilesize
9KB
MD5eddc568f4dd40a91e0dab3ac15047994
SHA1daa42961d015c155a722cf4fe9cfa4b4f9613edf
SHA256860b3f367bba2e94b995bb0f14d54478f1e6e2a0960390804e6907566b12417d
SHA5123e42552bcd57dfbe5e469d07762a6d175bb673b67ab54f025dc4bf82987d423b084554a29797cd71b05a4bbb4dcd76f58a8571d9344fb1a0d207089ac9e00711
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs-1.jsFilesize
8KB
MD55086431568b6721474ae5d9e3de15d55
SHA1e3d1d8bc1ccf5b9698d1996b5eacf5dbd8bd2128
SHA256e39981287c1afd8aa90b64564ff789e575c9b8b26577fa77e6105e8b060b1bc5
SHA512829f740b01fd2192314ef68412e129727b9d614161369b6f88fea3e6408a9ccb4f83e4937edd433d784f3d85d328c31352d2e08f0eeff94dadd43ae2431f12a3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs.jsFilesize
8KB
MD53a374b298e35d21e52100ea8a2b277e0
SHA1da07619673a049e293ba7de7121b592041cba75a
SHA2566fe76e2be121ece58646e5020a83f3086dc8b114511f24276d13a05313dfe064
SHA512e191ac96cfded1672a427d59a3cf074ffdced5bc3ccea6779270e5e0dce01fffffd129f58fcedf795e826c3a9a1afb621417dcdb4bd4634b36fc4f41f9a51c2e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs.jsFilesize
8KB
MD5aa5f34a5f4b5024260049c90daedece3
SHA115674828a0dd43da08d6dbc4fb7ee77f0a94f98f
SHA256cd523070b681482f32d04a2f32904e120c267c67222c8b4ceea34f2045b6d11d
SHA5129ebd514987f3e812a4fc51c1d926dd921cf61cf67a1ecee48aa212e634c6fb8671f4ec3c64fe913b6d537c4a151d1d9ec2790de9566d7e4dec38d2abcdfa1fe2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\prefs.jsFilesize
9KB
MD583a9c370a05d78f2ab328ed1648a38b5
SHA18e2c250eb2620c9c3eaf3ee78de25e54d7249dc4
SHA2568c60e3f8db44c5c8173646434a075e6d2bc69eaac116aec7df7342f01b3d1e8d
SHA512295bcad229f3f96a60213c9700b22abf9b6bee711d6a3e869557222fd958d9e0e0872a4252a6a3e658cef08d6ee8026f35b263bcb178b89462d62518b3f9e635
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionCheckpoints.jsonFilesize
53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionCheckpoints.jsonFilesize
122B
MD599601438ae1349b653fcd00278943f90
SHA18958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA25672d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
SHA512ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionCheckpoints.jsonFilesize
146B
MD565690c43c42921410ec8043e34f09079
SHA1362add4dbd0c978ae222a354a4e8d35563da14b4
SHA2567343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
SHA512c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionCheckpoints.jsonFilesize
90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionstore-backups\recovery.baklz4Filesize
4KB
MD5d19aa39d7c8df99903e334a7dbbef5e9
SHA17a7fb3a51bcdaa0b784d5fe8b3082681171e8a5f
SHA25620a30945af81b8ad1f35f8130de3a2c77bda09d99f88cb74123aa21769321d35
SHA5123d8ccbf8113ad729a4f5a1477978cd2743db100a3d1c70506f0e37070dffdf7ab0b91863b718bcfe6c0d0107105ec2e61b4fe03d407ffe9ce9d4912000c8714c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionstore-backups\recovery.baklz4Filesize
4KB
MD565f462e841aa718f17411f8372ac5518
SHA12e87174b2e2d403506bd354cdfbac4de4499acdf
SHA256a7cb56c92fd75d0531386a1f8dd9cf47fd83ff90cc34ae90a7995fac7040e261
SHA512b880bf00b3aa0c893950f8b1cf7ac6e38a083a8ca014a7b0d1b5ffc24afb670df8817c3b4e082d740a0d06ee4af9ee6f5b65bccb00bac3ff6857f76843bdc13e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionstore-backups\recovery.baklz4Filesize
4KB
MD536a30fe481c063a5906b3946c0cdd19c
SHA1b4f55d9d88839ab56d6b6ee371ac8985fc719894
SHA256fd44ff916d573bfde1f50f0ee5cd7c0e231b0e4dbf7ba85b29689187fa9b949b
SHA512df987b58525c4ecb7703a19c60b3dcf26562b99c0577dd071dafcc19be8a37cc6ff0479ac6b3973692f11e530ab06e5c1ec96c6189fc96df75dce6fd2c00d401
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionstore-backups\recovery.baklz4Filesize
5KB
MD53f44d15098e45afce0c1e2521073340b
SHA12b51c72d7d6587d27546278fa1e1b648710afa40
SHA2566625fe66b2c91e98bb49c6bd8dd92ce97339304bff8df29469cba0f49ba389eb
SHA512dd62e3363d46d91b34109cc5dc86b4fb5ceee69f8131fae9397320955bd089037deb58292984cd062ed10ebcc7a9e8db9faf8ae6469452945e478ba5766ae17f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionstore-backups\recovery.baklz4Filesize
4KB
MD5e222048a40ba9ffcc56e52359eb145c4
SHA112376ff896c92dbb72c518f86b2e7efeff83e5ef
SHA256a5268bc687ffc7dfef612c0bb60f6ccba51cda1e7139fa08f2b3e0e165fe1157
SHA5124b0ee03b39d552a4b17b26cbe745676cad0dba38a32a070130037f106bf83a5c58eafc25a2487dbb29676ad61ba3481756ef4c1b53061002b6d4b307e4993911
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionstore-backups\recovery.baklz4Filesize
5KB
MD5a0ac67feba829375b07be89110828db7
SHA1cf923606f1f660512c0090ac7f100572b7d99561
SHA2567add9b284bf1468a49f2fe8e469041017db2b60c8631bb19fe06cae95f427a93
SHA51282f5366d309f72d2f22e90ce33013cef1930d11777b2e22cbae51017b5fea57b89d377656e7d03b33552e2ee7a5acbd4e33041d587935dff574fb6e503b6442d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\md1ejlmw.default-release\sessionstore-backups\recovery.baklz4Filesize
4KB
MD54a129fc456a889a108fc15734e81ad62
SHA160d5925e5ece5e7fdbedf516e5c1e5fa0c661a8c
SHA25672ac54696eab399932390db8638f324a9c2eaabd1fce48072c4930cd55b679af
SHA5123c68dc58ca78cd91a2f2c6a12a21865ada7c7ad94ad41772bb4dabdc1a2d77e935250c1ff25ea6af2b6c2bf98ecd93cd81dc0f38b3f686207a739d833ee9d682
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Users\Admin\Downloads\BlitzedGrabberX96.rarFilesize
5.7MB
MD5ee64a0b68d67da34ac76c56b2c66d4ba
SHA1ecff5c05e9b6ba69bcc79994fe6aaf2a4721a103
SHA256471b1264bcc332dcfa69187ff322df257d039bc2503765fec497b3b5fdbda0e9
SHA51298be317b5535464d377ac522428472381f45fb9c2329059c565c18e52fb82a52a2dad91ab85a88dd6669bce340f8b87312d7e41d66b7d0f71429702c922d2fb1
-
C:\Users\Admin\Downloads\Unconfirmed 954318.crdownloadFilesize
1.5MB
MD5e5788b13546156281bf0a4b38bdd0901
SHA17df28d340d7084647921cc25a8c2068bb192bdbb
SHA25626cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
SHA5121f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff
-
C:\Users\Admin\Downloads\dotNetFx35setup.qsMaROnX.exe.partFilesize
2.7MB
MD5269f314b87e6222a20e5f745b6b89783
SHA1b0ca05c12ebb9a3610206bad7f219e02b7873cbd
SHA256c05a019ce69c2e6973e464f381c2b0b618ad9b135ca5275b052febf64c9f9257
SHA51234c574c78315cb83aac1b763a4f26f978d6c80d8e5bd61b601d16fdce2bccc109f8b46f03fb938a2ff2b9acb4793313f75b15539006e72b827ff7673507e5beb
-
C:\Windows\SysWOW64\WindowsInput.exeFilesize
21KB
MD5e6fcf516d8ed8d0d4427f86e08d0d435
SHA1c7691731583ab7890086635cb7f3e4c22ca5e409
SHA2568dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337
SHA512c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e
-
C:\Windows\SysWOW64\WindowsInput.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\??\c:\Users\Admin\AppData\Local\Temp\CSCDC42.tmpFilesize
676B
MD5e0902b383db7db5d6ee104dfe5d5bbf2
SHA1660645f09cb0d50dbcfa21e9ecc79c098a7a3f7e
SHA2560feec7b6f4e921af840818dc12d20c027ef8ebb28dd84f7383a4155e7ab1002d
SHA512f760c39d1922cf68854d22991ceadb97a14dc299afe5a5b4ccccf25b91931dfa7ed7067b6204de01fb3d5d4326a69a3a76bb285cf6fd1f8f2b7d9d5c284149e6
-
\??\c:\Users\Admin\AppData\Local\Temp\ixyvcef2.0.csFilesize
208KB
MD5f0476b23c51f40e22e95afcdea24562b
SHA13cf02cd8b5d9caf0b3fa52aebaac6c22544270e2
SHA25611838b87940e806e0b31c4ea761f33003168ce18bd963ac95ae6a5b046ae465f
SHA512a53f386c22187b4fc173702b302c63983f06190befeeb55866957ebf264d2482e62a3c1c55208d6c9d8b05231a4ac84691d8d9b981ad90cbffca66fda86fcea3
-
\??\c:\Users\Admin\AppData\Local\Temp\ixyvcef2.cmdlineFilesize
349B
MD5a147fbe49d439ace084776461e99a496
SHA1cc9b9fa0077a5826ca353ad01f7c4436e2b763e7
SHA2561a89fc4f5698c4500c36326a0d050ffdad5b065708003c95e65a02c96374c52a
SHA51277cf30b12fad0a78f5c892092c80c44c9ee5c75aed23b3ca9f73b87be22f5884e6779d83f067833969581cef884b97a116297618bfff92e92611de90934ad0f7
-
\??\pipe\LOCAL\crashpad_3700_TTZMLWKMBADAYNPSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1472-875-0x00000000006E0000-0x00000000006E8000-memory.dmpFilesize
32KB
-
memory/1808-706-0x000002942E390000-0x000002942E3B2000-memory.dmpFilesize
136KB
-
memory/2292-804-0x0000000019F50000-0x000000001A05A000-memory.dmpFilesize
1.0MB
-
memory/2320-782-0x00000000015C0000-0x00000000015C8000-memory.dmpFilesize
32KB
-
memory/2320-761-0x000000001BD40000-0x000000001BD9C000-memory.dmpFilesize
368KB
-
memory/2320-764-0x000000001BF00000-0x000000001BF0E000-memory.dmpFilesize
56KB
-
memory/2320-765-0x000000001C3F0000-0x000000001C8BE000-memory.dmpFilesize
4.8MB
-
memory/2320-766-0x000000001C960000-0x000000001C9FC000-memory.dmpFilesize
624KB
-
memory/2320-779-0x000000001D020000-0x000000001D036000-memory.dmpFilesize
88KB
-
memory/2320-781-0x0000000001840000-0x0000000001852000-memory.dmpFilesize
72KB
-
memory/2320-783-0x000000001D060000-0x000000001D080000-memory.dmpFilesize
128KB
-
memory/3344-799-0x000000001B540000-0x000000001B57C000-memory.dmpFilesize
240KB
-
memory/3344-798-0x0000000001360000-0x0000000001372000-memory.dmpFilesize
72KB
-
memory/3344-797-0x0000000000A50000-0x0000000000A5C000-memory.dmpFilesize
48KB
-
memory/4476-1048-0x0000000001200000-0x0000000001212000-memory.dmpFilesize
72KB
-
memory/4476-879-0x0000000071740000-0x0000000071777000-memory.dmpFilesize
220KB
-
memory/4476-820-0x0000000005CA0000-0x0000000006244000-memory.dmpFilesize
5.6MB
-
memory/4476-1046-0x00000000010F0000-0x00000000010FA000-memory.dmpFilesize
40KB
-
memory/4476-826-0x0000000006250000-0x0000000006442000-memory.dmpFilesize
1.9MB
-
memory/4476-834-0x0000000073A90000-0x0000000073B19000-memory.dmpFilesize
548KB
-
memory/4476-1049-0x0000000001260000-0x000000000129C000-memory.dmpFilesize
240KB
-
memory/4476-839-0x00000000717A0000-0x00000000717D7000-memory.dmpFilesize
220KB
-
memory/4476-822-0x0000000005630000-0x000000000563A000-memory.dmpFilesize
40KB
-
memory/4476-821-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/4476-819-0x0000000000B50000-0x0000000000C24000-memory.dmpFilesize
848KB
-
memory/4476-2271-0x00000000717A0000-0x00000000717D7000-memory.dmpFilesize
220KB
-
memory/4476-842-0x00000000069D0000-0x0000000006AB0000-memory.dmpFilesize
896KB
-
memory/4476-878-0x00000000717A0000-0x00000000717D7000-memory.dmpFilesize
220KB
-
memory/4476-843-0x00000000068F0000-0x0000000006932000-memory.dmpFilesize
264KB
-
memory/4476-844-0x0000000006C60000-0x0000000006E08000-memory.dmpFilesize
1.7MB
-
memory/4476-851-0x0000000071740000-0x0000000071777000-memory.dmpFilesize
220KB
-
memory/4476-856-0x0000000006FB0000-0x000000000704C000-memory.dmpFilesize
624KB
-
memory/4476-838-0x0000000005C60000-0x0000000005C82000-memory.dmpFilesize
136KB
-
memory/4476-1047-0x0000000001120000-0x000000000113A000-memory.dmpFilesize
104KB
-
memory/5240-864-0x000000001BB00000-0x000000001BB10000-memory.dmpFilesize
64KB
-
memory/5240-863-0x000000001C2C0000-0x000000001C482000-memory.dmpFilesize
1.8MB
-
memory/5240-862-0x000000001BAD0000-0x000000001BAE8000-memory.dmpFilesize
96KB
-
memory/5240-861-0x000000001B820000-0x000000001B86E000-memory.dmpFilesize
312KB
-
memory/5240-860-0x0000000002ED0000-0x0000000002EE2000-memory.dmpFilesize
72KB
-
memory/5240-859-0x0000000000CD0000-0x0000000000DBC000-memory.dmpFilesize
944KB
-
memory/6036-672-0x0000000000E70000-0x000000000130A000-memory.dmpFilesize
4.6MB