Overview

overview

10

Static

static

3

Nursultan ...ck.exe

windows10-2004-x64

10

Nursultan ...ck.exe

windows11-21h2-x64

10

Resubmissions

11/10/2024, 09:26

241011-leelcawcpg10

25/06/2024, 13:03

240625-qata6avanq10

25/06/2024, 13:01

240625-p87e1athqp10

25/06/2024, 12:57

240625-p7d23atgqn10

25/06/2024, 12:54

240625-p5krtstfrk10

25/06/2024, 12:54

240625-p5e7ca1cmg

25/06/2024, 12:45

240625-py935szhpd10

25/06/2024, 12:32

240625-pq3n4ashnk10

Analysis

  • max time kernel
    454s
  • max time network
    471s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/06/2024, 12:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Nursultan NextGen Crack.exe
  • Size 213KB
  • Sample240625-py935szhpd
  • SHA256 e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xwormdiscoveryevasionexecutionpersistenceprivilege_escalationrattrojanupx

Malware Config

Extracted

Family

  • xworm

C2

  • seems-poet.gl.at.ply.gg:30996

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    ratka.exe

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 11 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
      "C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"
      2⤵
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:32
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4800
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nursultan NextGen Crack.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5096
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4584
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\wininit"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1732
      • C:\Windows\System32\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /im ngrok.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6744
      • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
        "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" config add-authtoken 123
        3⤵
        • Executes dropped EXE
        PID:6880
      • C:\Windows\System32\netsh.exe
        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:952
      • C:\Windows\SYSTEM32\MsiExec.exe
        MsiExec.exe /I{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}
        3⤵
        • Enumerates connected drives
        • Suspicious use of FindShellTrayWindow
        PID:6708
      • C:\Windows\SYSTEM32\MsiExec.exe
        MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9}
        3⤵
          PID:5568
        • C:\Windows\SYSTEM32\MsiExec.exe
          MsiExec.exe /X{7DAD0258-515C-3DD4-8964-BD714199E0F7}
          3⤵
            PID:5560
          • C:\Windows\SYSTEM32\MsiExec.exe
            MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-AC0F074E4100}
            3⤵
            • Enumerates connected drives
            • Suspicious use of FindShellTrayWindow
            PID:6888
          • C:\Windows\SYSTEM32\MsiExec.exe
            MsiExec.exe /X{9F51D16B-42E8-4A4A-8228-75045541A2AE}
            3⤵
              PID:7084
            • C:\Windows\SYSTEM32\MsiExec.exe
              MsiExec.exe /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
              3⤵
                PID:5536
              • C:\Windows\SYSTEM32\MsiExec.exe
                MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
                3⤵
                  PID:5616
                • C:\Windows\SYSTEM32\MsiExec.exe
                  MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
                  3⤵
                    PID:5116
                  • C:\Windows\SYSTEM32\MsiExec.exe
                    MsiExec.exe /X{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}
                    3⤵
                      PID:5600
                    • C:\Windows\SYSTEM32\MsiExec.exe
                      MsiExec.exe /X{C7B73281-AB0A-4DAD-A09F-5C30D40679AC}
                      3⤵
                        PID:6492
                      • C:\Windows\SYSTEM32\MsiExec.exe
                        MsiExec.exe /I{64A3A4F4-B792-11D6-A78A-00B0D0180381}
                        3⤵
                        • Enumerates connected drives
                        • Checks processor information in registry
                        • Suspicious use of FindShellTrayWindow
                        PID:3480
                      • C:\Windows\SYSTEM32\MsiExec.exe
                        MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
                        3⤵
                          PID:2936
                        • C:\Windows\SYSTEM32\MsiExec.exe
                          MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F}
                          3⤵
                            PID:5556
                          • C:\Windows\SYSTEM32\MsiExec.exe
                            MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
                            3⤵
                              PID:6684
                            • C:\Windows\SYSTEM32\MsiExec.exe
                              MsiExec.exe /X{7447A794-FA2E-42BE-BA9A-5FCBD54C5DF3}
                              3⤵
                                PID:6384
                              • C:\Windows\SYSTEM32\MsiExec.exe
                                MsiExec.exe /X{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}
                                3⤵
                                  PID:6908
                                • C:\Windows\SYSTEM32\MsiExec.exe
                                  MsiExec.exe /X{37B8F9C7-03FB-3253-8781-2517C99D7C00}
                                  3⤵
                                    PID:7052
                                  • C:\Windows\SYSTEM32\MsiExec.exe
                                    MsiExec.exe /I{662A0088-6FCD-45DD-9EA7-68674058AED5}
                                    3⤵
                                    • Enumerates connected drives
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1632
                                  • C:\Windows\SYSTEM32\MsiExec.exe
                                    MsiExec.exe /X{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}
                                    3⤵
                                      PID:4908
                                    • C:\Windows\SYSTEM32\MsiExec.exe
                                      MsiExec.exe /I{BF08E976-B92E-4336-B56F-2171179476C4}
                                      3⤵
                                      • Enumerates connected drives
                                      • Suspicious use of FindShellTrayWindow
                                      PID:6404
                                    • C:\Windows\SYSTEM32\MsiExec.exe
                                      MsiExec.exe /X{BCC2FB07-8CF0-4542-B10C-61BCEF04AFF2}
                                      3⤵
                                        PID:6596
                                      • C:\Windows\SYSTEM32\MsiExec.exe
                                        MsiExec.exe /X{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}
                                        3⤵
                                          PID:6408
                                        • C:\Windows\SYSTEM32\MsiExec.exe
                                          MsiExec.exe /X{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}
                                          3⤵
                                            PID:6820
                                          • C:\Windows\SYSTEM32\MsiExec.exe
                                            MsiExec.exe /X{CB0836EC-B072-368D-82B2-D3470BF95707}
                                            3⤵
                                              PID:6164
                                            • C:\Windows\SYSTEM32\MsiExec.exe
                                              MsiExec.exe /I{71024AE4-039E-4CA4-87B4-2F64180401F0}
                                              3⤵
                                              • Enumerates connected drives
                                              • Checks processor information in registry
                                              • Suspicious use of FindShellTrayWindow
                                              PID:3708
                                            • C:\Windows\SYSTEM32\MsiExec.exe
                                              MsiExec.exe /I{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}
                                              3⤵
                                              • Enumerates connected drives
                                              • Suspicious use of FindShellTrayWindow
                                              PID:5484
                                            • C:\Windows\SYSTEM32\MsiExec.exe
                                              MsiExec.exe /X{E634F316-BEB6-4FB3-A612-F7102F576165}
                                              3⤵
                                                PID:5228
                                              • C:\Windows\SYSTEM32\MsiExec.exe
                                                MsiExec.exe /X{01B2627D-8443-41C0-97F0-9F72AC2FD6A0}
                                                3⤵
                                                  PID:5320
                                                • C:\Windows\SYSTEM32\MsiExec.exe
                                                  MsiExec.exe /X{D46F1FD9-2FE8-4D05-B2AC-011C23B69B24}
                                                  3⤵
                                                    PID:4668
                                                  • C:\Windows\SYSTEM32\MsiExec.exe
                                                    MsiExec.exe /X{90160000-008C-0000-1000-0000000FF1CE}
                                                    3⤵
                                                      PID:6988
                                                    • C:\Windows\SYSTEM32\MsiExec.exe
                                                      MsiExec.exe /I{90160000-007E-0000-1000-0000000FF1CE}
                                                      3⤵
                                                      • Enumerates connected drives
                                                      • Suspicious use of FindShellTrayWindow
                                                      PID:5840
                                                    • C:\Windows\SYSTEM32\MsiExec.exe
                                                      MsiExec.exe /X{90160000-008C-0409-1000-0000000FF1CE}
                                                      3⤵
                                                        PID:5724
                                                      • C:\Windows\SYSTEM32\MsiExec.exe
                                                        MsiExec.exe /X{2BB73336-4F69-4141-9797-E9BD6FE3980A}
                                                        3⤵
                                                          PID:3956
                                                        • C:\Windows\SYSTEM32\MsiExec.exe
                                                          MsiExec.exe /X{79043ED0-7ED1-4227-A5E5-04C5594D21F7}
                                                          3⤵
                                                            PID:4712
                                                          • C:\Windows\SYSTEM32\taskkill.exe
                                                            taskkill /F /IM explorer.exe
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1796
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\и.bat" "
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1280
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            3⤵
                                                              PID:2284
                                                            • C:\Windows\system32\choice.exe
                                                              choice /c 12 /n /m "Enter your choice:"
                                                              3⤵
                                                                PID:1996
                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2808
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                            1⤵
                                                              PID:3256
                                                            • C:\Users\Admin\wininit
                                                              C:\Users\Admin\wininit
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4708
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                              1⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3752
                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                2⤵
                                                                • Checks processor information in registry
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1904
                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.0.275924726\917746860" -parentBuildID 20230214051806 -prefsHandle 1752 -prefMapHandle 1744 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f0142e1-51f5-4ec3-9240-3e5e170c2355} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 1832 2df908c2858 gpu
                                                                  3⤵
                                                                    PID:3468
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.1.146440821\700021077" -parentBuildID 20230214051806 -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88228470-3a94-48c2-b42f-cd6066af08aa} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 2356 2df84785358 socket
                                                                    3⤵
                                                                    • Checks processor information in registry
                                                                    PID:2972
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.2.174747166\75368795" -childID 1 -isForBrowser -prefsHandle 2924 -prefMapHandle 2920 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c50e683e-16a6-4807-8b63-45b3edac4281} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 2932 2df90490858 tab
                                                                    3⤵
                                                                      PID:3112
                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.3.1045039126\2053172858" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 2640 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0828b270-9068-404c-922d-c0873986b2aa} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 3576 2df96e88e58 tab
                                                                      3⤵
                                                                        PID:1396
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.4.956959532\118798927" -childID 3 -isForBrowser -prefsHandle 5072 -prefMapHandle 5140 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e46252ef-72b1-476d-bb54-b84fc28aa8df} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5116 2df986fd958 tab
                                                                        3⤵
                                                                          PID:496
                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.5.1044836342\55105560" -childID 4 -isForBrowser -prefsHandle 5304 -prefMapHandle 5308 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff55e700-1976-4735-a9f5-a3e9997cdceb} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5296 2df995d4058 tab
                                                                          3⤵
                                                                            PID:768
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.6.195823850\321816344" -childID 5 -isForBrowser -prefsHandle 5500 -prefMapHandle 5508 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3070917a-f0f1-41f9-840e-35d48d427941} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5492 2df995d5558 tab
                                                                            3⤵
                                                                              PID:2888
                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.7.1851671827\701759316" -childID 6 -isForBrowser -prefsHandle 2792 -prefMapHandle 3460 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1df09990-1432-4313-a635-c2059cb27809} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 4028 2df93bc0e58 tab
                                                                              3⤵
                                                                                PID:6148
                                                                          • C:\Windows\system32\DisplaySwitch.exe
                                                                            DisplaySwitch.exe
                                                                            1⤵
                                                                              PID:3916
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
                                                                              1⤵
                                                                                PID:2804
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
                                                                                1⤵
                                                                                  PID:2284
                                                                                • C:\Windows\System32\rundll32.exe
                                                                                  C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
                                                                                  1⤵
                                                                                    PID:5212
                                                                                  • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                    C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                    1⤵
                                                                                    • Drops file in Windows directory
                                                                                    PID:5568
                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                    1⤵
                                                                                      PID:5604
                                                                                    • C:\Windows\system32\DisplaySwitch.exe
                                                                                      DisplaySwitch.exe
                                                                                      1⤵
                                                                                        PID:5996
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                        1⤵
                                                                                        • Enumerates system info in registry
                                                                                        • Modifies data under HKEY_USERS
                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        • Suspicious use of SendNotifyMessage
                                                                                        PID:3532
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbde65ab58,0x7ffbde65ab68,0x7ffbde65ab78
                                                                                          2⤵
                                                                                            PID:5132
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:2
                                                                                            2⤵
                                                                                              PID:5916
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                              2⤵
                                                                                                PID:5848
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:5952
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5968
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3092 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5972
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4220 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:3916
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4204 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:3364
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4384 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:5048
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:5900
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:5920
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:6284
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:6748
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:6812
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                                      2⤵
                                                                                                                        PID:6876
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3248 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:2
                                                                                                                        2⤵
                                                                                                                          PID:6264
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4460 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:1964
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                                            2⤵
                                                                                                                              PID:2964
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 --field-trial-handle=1972,i,4559477141036434237,3454111153606035002,131072 /prefetch:8
                                                                                                                              2⤵
                                                                                                                                PID:6572
                                                                                                                            • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                              1⤵
                                                                                                                                PID:5448
                                                                                                                              • C:\Windows\system32\DisplaySwitch.exe
                                                                                                                                DisplaySwitch.exe
                                                                                                                                1⤵
                                                                                                                                  PID:5984
                                                                                                                                • C:\Users\Admin\wininit
                                                                                                                                  C:\Users\Admin\wininit
                                                                                                                                  1⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:7084
                                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:6096
                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:5444
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                                                                                                                                    1⤵
                                                                                                                                      PID:6716
                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:4180
                                                                                                                                      • C:\Users\Admin\wininit
                                                                                                                                        C:\Users\Admin\wininit
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:6244
                                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C0
                                                                                                                                        1⤵
                                                                                                                                          PID:688
                                                                                                                                        • C:\Users\Admin\wininit
                                                                                                                                          C:\Users\Admin\wininit
                                                                                                                                          1⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:6384
                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                          1⤵
                                                                                                                                            PID:5832
                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              • Modifies registry class
                                                                                                                                              • NTFS ADS
                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:5136
                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.0.875357676\303355245" -parentBuildID 20230214051806 -prefsHandle 1708 -prefMapHandle 1700 -prefsLen 22484 -prefMapSize 235208 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93fc92f8-cbb9-4b24-bee8-777acb20e8d9} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 1608 1ef07922f58 gpu
                                                                                                                                                3⤵
                                                                                                                                                  PID:3180
                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.1.1069390618\1963344058" -parentBuildID 20230214051806 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 22484 -prefMapSize 235208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2970c55d-932a-4d23-919e-f7a587a32025} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 2232 1ef7b88a558 socket
                                                                                                                                                  3⤵
                                                                                                                                                    PID:7036
                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.2.941851982\615664076" -childID 1 -isForBrowser -prefsHandle 3020 -prefMapHandle 3036 -prefsLen 22880 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cdd5409-6d6f-4469-92cd-90d1d85fca3b} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 2684 1ef0ba0ff58 tab
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1628
                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.3.81376150\1612812879" -childID 2 -isForBrowser -prefsHandle 3496 -prefMapHandle 3492 -prefsLen 28346 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa3a21f2-9a72-4aa5-8755-53d11ea2a0aa} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 3504 1ef0dce6b58 tab
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5128
                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.4.45621807\671645759" -childID 3 -isForBrowser -prefsHandle 5024 -prefMapHandle 5020 -prefsLen 28346 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a59a5da-b104-4d53-93b6-b014ab6575ef} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 5040 1ef0fa7fe58 tab
                                                                                                                                                        3⤵
                                                                                                                                                          PID:428
                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.5.600051033\1718866529" -childID 4 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 28346 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6484e38d-8cb9-4fc1-831c-68f6f3af92ab} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 5160 1ef10416858 tab
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4964
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.6.551616193\149894371" -childID 5 -isForBrowser -prefsHandle 5448 -prefMapHandle 5444 -prefsLen 28346 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a25afb83-826c-4a83-895c-942200efa723} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 5456 1ef104c7658 tab
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3020
                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.7.912271151\633927157" -childID 6 -isForBrowser -prefsHandle 5784 -prefMapHandle 5780 -prefsLen 28346 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c24ecb8-16db-40d4-994d-502de461cb3f} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 5796 1ef11c18b58 tab
                                                                                                                                                              3⤵
                                                                                                                                                                PID:704
                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.8.1573044007\100775569" -childID 7 -isForBrowser -prefsHandle 5040 -prefMapHandle 5036 -prefsLen 28346 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {311fdcdc-bbe3-4852-93d5-73d4996f42fc} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 5976 1ef11910e58 tab
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5360
                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.9.2043715575\431917272" -childID 8 -isForBrowser -prefsHandle 5044 -prefMapHandle 5592 -prefsLen 28355 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ad75d3f-f144-4516-a0d4-7d3da1d8e175} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 5412 1ef11c17058 tab
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6472
                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.10.793236605\301440004" -childID 9 -isForBrowser -prefsHandle 6196 -prefMapHandle 6200 -prefsLen 28355 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a563a5d-c25e-46dd-ba6f-497ba25cd0bd} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 6184 1ef12467e58 tab
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2760
                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5136.11.1801255500\1584993984" -childID 10 -isForBrowser -prefsHandle 6472 -prefMapHandle 6468 -prefsLen 28355 -prefMapSize 235208 -jsInitHandle 976 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {374b3ad8-02ac-4ab0-a3c6-34957b555433} 5136 "\\.\pipe\gecko-crash-server-pipe.5136" 6480 1ef0f41fe58 tab
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4652
                                                                                                                                                                      • C:\Users\Admin\Downloads\aida64extreme730.exe
                                                                                                                                                                        "C:\Users\Admin\Downloads\aida64extreme730.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:3756
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-L5O71.tmp\aida64extreme730.tmp
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-L5O71.tmp\aida64extreme730.tmp" /SL5="$30174,51859982,56832,C:\Users\Admin\Downloads\aida64extreme730.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          PID:764
                                                                                                                                                                          • C:\Program Files (x86)\FinalWire\AIDA64 Extreme\aida64.exe
                                                                                                                                                                            "C:\Program Files (x86)\FinalWire\AIDA64 Extreme\aida64.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                            PID:3484
                                                                                                                                                                            • C:\Windows\System32\ie4uinit.exe
                                                                                                                                                                              "C:\Windows\System32\ie4uinit.exe" -ClearIconCache
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:6740
                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                      C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:3340
                                                                                                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                        C:\Windows\System32\MsiExec.exe -Embedding 0C93C95AA9B3BF6000ACEC914446538C C
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:4768
                                                                                                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                        C:\Windows\System32\MsiExec.exe -Embedding A4D5730D607D76DDADAA17EE79C5FE17 C
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:5628
                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 310125655B2F474F23CB7EC4DCD9D7AE C
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:2088
                                                                                                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                        C:\Windows\System32\MsiExec.exe -Embedding DC06E923884A576777AA1E132CB348BE
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                        PID:5500
                                                                                                                                                                    • C:\Users\Admin\wininit
                                                                                                                                                                      C:\Users\Admin\wininit
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:4256
                                                                                                                                                                    • C:\Users\Admin\wininit
                                                                                                                                                                      C:\Users\Admin\wininit
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:1512
                                                                                                                                                                    • C:\Users\Admin\wininit
                                                                                                                                                                      C:\Users\Admin\wininit
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:3408
                                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      PID:6376
                                                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                                                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:2828
                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                        C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                        PID:6800
                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                          "C:\Windows\explorer.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          PID:4792
                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2144
                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:4756
                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4756.0.1557007371\591080285" -parentBuildID 20230214051806 -prefsHandle 1696 -prefMapHandle 1688 -prefsLen 24458 -prefMapSize 235380 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cea7204e-4409-4070-a27f-af8dc63def01} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" 1780 236d7524858 gpu
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:4216
                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4756.1.401038634\374382183" -parentBuildID 20230214051806 -prefsHandle 2220 -prefMapHandle 2216 -prefsLen 24458 -prefMapSize 235380 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4f82b78-7d51-47a4-9223-80a1da0b272b} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" 2232 236cb289658 socket
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:4028
                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4756.2.822381599\1780858027" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3116 -prefsLen 24854 -prefMapSize 235380 -jsInitHandle 1060 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {033c922d-41fc-475c-a190-18a553c8529c} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" 3128 236da82ab58 tab
                                                                                                                                                                                        5⤵
                                                                                                                                                                                          PID:6876
                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4756.3.554853271\724390326" -childID 2 -isForBrowser -prefsHandle 3576 -prefMapHandle 3572 -prefsLen 29448 -prefMapSize 235380 -jsInitHandle 1060 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10b0350b-461b-462f-87bf-6a8a740be6ff} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" 3584 236dd459658 tab
                                                                                                                                                                                          5⤵
                                                                                                                                                                                            PID:3048
                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4756.4.428928837\106845635" -childID 3 -isForBrowser -prefsHandle 4768 -prefMapHandle 4764 -prefsLen 30263 -prefMapSize 235380 -jsInitHandle 1060 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f2bdfd9-6754-4e57-aaa2-69861af8917f} 4756 "\\.\pipe\gecko-crash-server-pipe.4756" 4780 236ded23258 tab
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:6448
                                                                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4436
                                                                                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:5320
                                                                                                                                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:3316
                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:5708
                                                                                                                                                                                      • C:\Windows\system32\dwm.exe
                                                                                                                                                                                        "dwm.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:1440
                                                                                                                                                                                        • C:\Windows\system32\dwm.exe
                                                                                                                                                                                          "dwm.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:1684
                                                                                                                                                                                          • C:\Windows\system32\dwm.exe
                                                                                                                                                                                            "dwm.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:6372
                                                                                                                                                                                            • C:\Windows\system32\dwm.exe
                                                                                                                                                                                              "dwm.exe"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:2244
                                                                                                                                                                                              • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                "dwm.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                  "dwm.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:6352
                                                                                                                                                                                                  • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                    "dwm.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5728
                                                                                                                                                                                                    • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                      "dwm.exe"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004C0
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                        • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                          "LogonUI.exe" /flags:0x0 /state0:0xa39b5855 /state1:0x41c64e6d
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3772
                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4336

                                                                                                                                                                                                            Network

                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Active Setup

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.014

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                  Accessibility Features

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1546.008

                                                                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1546.007

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                  Active Setup

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.014

                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                  Accessibility Features

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1546.008

                                                                                                                                                                                                                  Netsh Helper DLL

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1546.007

                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                                                                  1
                                                                                                                                                                                                                  T1562.004

                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                  3
                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                  2
                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                  6
                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                  5
                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  e5bc1e7.rbs
                                                                                                                                                                                                                  • Path C:\Config.Msi\e5bc1e7.rbs
                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                  • SHA256 36306ae332f4791661890737a1d263dcf08ae01f7684b86e92d929d720eb15f8
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  e5bc1ea.rbs
                                                                                                                                                                                                                  • Path C:\Config.Msi\e5bc1ea.rbs
                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                  • SHA256 2c80985fa449f4f8bce481fa876c7c9f794d34ae0632364f785db0255bba4ea4
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  e5bc1ed.rbs
                                                                                                                                                                                                                  • Path C:\Config.Msi\e5bc1ed.rbs
                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                  • SHA256 3e36fad53cb1e5dd3afa3b35f16b0f61cb4a74c830812943ee165675ebad6ff9
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  e5bc1f0.rbs
                                                                                                                                                                                                                  • Path C:\Config.Msi\e5bc1f0.rbs
                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                  • SHA256 ce563929a5eb8008df87d01fb9fcdfdc6071892cd323d4b2675a65995d7c4a60
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  e5bc1f3.rbs
                                                                                                                                                                                                                  • Path C:\Config.Msi\e5bc1f3.rbs
                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                  • SHA256 ff6733af4f6850154a297ea783f796e8c932bdce04a46f74126a2d0f864c3e03
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  e5bc1fe.rbf
                                                                                                                                                                                                                  • Path C:\Config.Msi\e5bc1fe.rbf
                                                                                                                                                                                                                  • Size 3B
                                                                                                                                                                                                                  • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  aida64.exe
                                                                                                                                                                                                                  • Path C:\Program Files (x86)\FinalWire\AIDA64 Extreme\aida64.exe
                                                                                                                                                                                                                  • Size 22.1MB
                                                                                                                                                                                                                  • SHA256 7b18ea8f307e09c369e7ff42b1a3acb5e5265f42173ab412b4dc788455df130b
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                  • SHA256 a7d4c600176462eba83010099537d78b4db3f5a26a5c6df8d0f2f00b562057ab
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  SCT Auditing Pending Reports
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  TransportSecurity
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                  • Size 356B
                                                                                                                                                                                                                  • SHA256 200ccb17dd84e70b4a6d81e3efea172fc2148b61625856cdaddbe61f216569c3
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                  • SHA256 686d7fe61cf20a9a4ada4c2944555a519fdd68cd6ed9fa4751995cf3d35620b0
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                  • SHA256 75d455178a19cee592d1b26c3063be6d7c7a878ab0ac0d51c1452c6b8fa4bbd7
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                  • SHA256 86849b3cd82e6c34da88761b3a7bf90eefb06c4afb44a7548388d1a1766f2f82
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                  • SHA256 bd85832883d29878450efa56a5cad584d7e1a27e6cdbb21e9240393f78b897b3
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Secure Preferences
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                  • SHA256 89246f41f5d35a581dcd1f2d81f3b2169068b69e1a2dc4863eab06cc89fdba48
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                  • Size 335KB
                                                                                                                                                                                                                  • SHA256 ee8a4b9ef3008a08d7f7c7b9d1ac1448bb48cea4d87e7627fb54963575c886fc
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                  • Size 283KB
                                                                                                                                                                                                                  • SHA256 d9b438435514d7783998b58000943f73ee80e2d38a124ecd79fb2304ecbe83a6
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                  • Size 283KB
                                                                                                                                                                                                                  • SHA256 eed77b043e1a58da114ca75e724f71499e2005f795d71db7485f7492e9c2ed1c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                  • Size 140KB
                                                                                                                                                                                                                  • SHA256 10d91d65b8c52d2119ca25c621ae2683b18260531b10387429a6f34ad8e4ad1a
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Module Info Cache
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
                                                                                                                                                                                                                  • Size 85KB
                                                                                                                                                                                                                  • SHA256 fb24e357ebaa43cd31a1ea30bc93f1dfbc58dc69dda699a6bc4f9a2cfcbae1b4
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Module Info Cache~RFe59479e.TMP
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59479e.TMP
                                                                                                                                                                                                                  • Size 82KB
                                                                                                                                                                                                                  • SHA256 2271396e999c47d105cde6e10829d4e30050eb00e71d14718d8f59d68287c0d5
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  powershell.exe.log
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                  • SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  wininit.log
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.log
                                                                                                                                                                                                                  • Size 654B
                                                                                                                                                                                                                  • SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  FileCoAuth-2024-6-25.1247.5604.1.odl
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-6-25.1247.5604.1.odl
                                                                                                                                                                                                                  • Size 706B
                                                                                                                                                                                                                  • SHA256 9bcb836125dbaabb19b017ce62286be9e9836979e05c3e5d956a0517735baf00
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  FileCoAuth-2024-6-25.1248.5444.1.odl
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-6-25.1248.5444.1.odl
                                                                                                                                                                                                                  • Size 706B
                                                                                                                                                                                                                  • SHA256 b2fded97caa0a9c42a3f81362b62637299f99ea6c05b991ddb48b96744b78f52
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  StartupProfileData-NonInteractive
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                  • Size 944B
                                                                                                                                                                                                                  • SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  StartupProfileData-NonInteractive
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                  • Size 944B
                                                                                                                                                                                                                  • SHA256 2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  StartupProfileData-NonInteractive
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                  • Size 944B
                                                                                                                                                                                                                  • SHA256 631632aac60e6815fb18144cce66425db89b75c1e9d2c4af46d9d5148b6f5f72
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  activity-stream.discovery_stream.json.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\activity-stream.discovery_stream.json.tmp
                                                                                                                                                                                                                  • Size 24KB
                                                                                                                                                                                                                  • SHA256 a144d21935d212069ee56bc143b2ba9c3a9aa99e3e38af7991c9b074b37a59c5
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  11919
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\doomed\11919
                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                  • SHA256 206ee37b5af43b3c2bc2ce3141b3b2edd3a979a8603ad913efeced651a5d9f12
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  19787
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\doomed\19787
                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                  • SHA256 10fd9a3bfb9fa98c131504574191da204f2ae9c36a6930503a333e1207f1bcb7
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  075B8FCF1E4761117058C2EFF149858F93A6A354
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\075B8FCF1E4761117058C2EFF149858F93A6A354
                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                  • SHA256 dd2e5734d51af91b3f651a2afb8a79ae8217d64b270ca4875c3b1106fc72b56e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  0BABF52A64DC7B1FCCDD563D131A086B80FE77E0
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\0BABF52A64DC7B1FCCDD563D131A086B80FE77E0
                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                  • SHA256 505072232e72a5b5e6345a3ae14ff7cf4b85973aff03663b2904307841f9350b
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  254256B27E0C48CF9B80B695F0B3B8CA84610495
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495
                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                  • SHA256 4cb071efd97b9d014369eb249e52b9e55eb625fca3528a47b7754d949a36ee37
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  383A97A57B113BD106DE6984E6DBA5F537327263
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                  • SHA256 d6f5bc8dd98fa6b6e29895cabe9959b341fe2f41c99e4ffbc1d510a41b30712f
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  383A97A57B113BD106DE6984E6DBA5F537327263
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                  • SHA256 a4b7fda8dd7d68554105d104cfa4a0c5bcab97e42ec2a4a5fabf9591bd3deb03
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  3C7712659D18F9BDD24B44DD2EE887F2D1CA3EAE
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\3C7712659D18F9BDD24B44DD2EE887F2D1CA3EAE
                                                                                                                                                                                                                  • Size 18KB
                                                                                                                                                                                                                  • SHA256 6ca20fc31338ea8f2acdaa5166db4cf806636c0a750ac582445d77490c0e08c2
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  54EA96798C26EF0ACA2E1D05572EA911A300BE26
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\54EA96798C26EF0ACA2E1D05572EA911A300BE26
                                                                                                                                                                                                                  • Size 135KB
                                                                                                                                                                                                                  • SHA256 c6733ffbf6cefcef83f3a1fd011dc3a9e6d24cdd3b8e56344fa6dcf8e8558632
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                  • SHA256 55ce8cec16c8f0726267fb2c9c9eceb1dbd5c8094554971611d2d25920a277cd
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  6D89348819C8881868053197CA0754F36784BF5F
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                  • SHA256 2c151bf98238f3358b85f7684463614f01192f4cc98a2c8e30380710aefea583
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  8540EC873F08CBAD5DF5121BD3BABF95624B4A14
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\8540EC873F08CBAD5DF5121BD3BABF95624B4A14
                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                  • SHA256 c5363e0d35ae21efc1f961bbc760ea2df7a85af367dc8670cf39f1f46cf1e06c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  C6A6389A9162CEB2E1F41436B370871FECA58F75
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\C6A6389A9162CEB2E1F41436B370871FECA58F75
                                                                                                                                                                                                                  • Size 60KB
                                                                                                                                                                                                                  • SHA256 041a988dfb06aedd40dde09ac11a235979635d3d86edf1518146ca00c6789cf0
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  D144A5C8C7E3227DABBD707932919BB599093AF0
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\D144A5C8C7E3227DABBD707932919BB599093AF0
                                                                                                                                                                                                                  • Size 174KB
                                                                                                                                                                                                                  • SHA256 c98c02adafbeab32da21fa320fc29feba83ad8c89d1560417b85114af93fd70e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\F18D85F52EBBBA2AB081EF739ED0D6E8A76D497C
                                                                                                                                                                                                                  • Size 298B
                                                                                                                                                                                                                  • SHA256 b7d5daca7fb2f49f442082e9c47918d0583940a4b17ae664f6ef7ac377f2820b
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  F96A1A8368D3C3DD1FA81D170326E6C1C65D342F
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\F96A1A8368D3C3DD1FA81D170326E6C1C65D342F
                                                                                                                                                                                                                  • Size 29KB
                                                                                                                                                                                                                  • SHA256 797239e41f2a1b3b5188c2be6b4fa9493e08364d42edd8a125592202c2e72f3c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  FFD8AD8D64C343A2A6ADF3BB0B35D1D20AAED475
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cache2\entries\FFD8AD8D64C343A2A6ADF3BB0B35D1D20AAED475
                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                  • SHA256 dc40fdba672533a381fa9639d7d8c54c691bd0c0f0b54b8a96103b248acedaa8
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  urlCache.bin
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bov3gdb6.default-release\startupCache\urlCache.bin
                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                  • SHA256 eec2012b0eabbe9c96538c7be02488c7645dca8af3018ae85253f8996ae9829d
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  www.bing[1].xml
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XU9N0J3P\www.bing[1].xml
                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                  • SHA256 916a5176f42c7e1af14f50ce7e28cda2a333c585ae8d4214b1dc5070a2df5cca
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  MSIC237.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\MSIC237.tmp
                                                                                                                                                                                                                  • Size 418KB
                                                                                                                                                                                                                  • SHA256 f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  __PSScriptPolicyTest_alvh1ln0.jry.ps1
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_alvh1ln0.jry.ps1
                                                                                                                                                                                                                  • Size 60B
                                                                                                                                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  jusched.log
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
                                                                                                                                                                                                                  • Size 297KB
                                                                                                                                                                                                                  • SHA256 e3d95c902057de39f34d4bbe59cfe44e6c5eb892d0e2572eca7aa4f1b9270231
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  ngrok.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                                                                                                                                                                                  • Size 26.9MB
                                                                                                                                                                                                                  • SHA256 2295878561b60d1c5470bd23a4a49091620aad27dce4ad1ff63026d88a4c7944
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  40371339ad31a7e6.customDestinations-ms
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                  • SHA256 158df55c7422b850bf8bee11fd98c69e1b6a5c5f856cf09c81afac80bbb583e0
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                                                                                                                                                                  • Size 19KB
                                                                                                                                                                                                                  • SHA256 e511f8ba652eb66193d85aecc6bc0dd11c094f43f41ca091de295fbf5634f9dd
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  AlternateServices.txt
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\AlternateServices.txt
                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                  • SHA256 fe9e34409c0585f8aebb0ee6e78356ade840bbf450c98fc1253c0c8173016dda
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  SiteSecurityServiceState.txt
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\SiteSecurityServiceState.txt
                                                                                                                                                                                                                  • Size 347B
                                                                                                                                                                                                                  • SHA256 e96ee2640347d38248774aabb881c022e22ac043008760702d305d1ba2e5813d
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  cert9.db
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cert9.db
                                                                                                                                                                                                                  • Size 224KB
                                                                                                                                                                                                                  • SHA256 e4a747acc607d0476b1e1d41a497ef502b07512b8c86820c5dd021d46db63b9e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  cookies.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\cookies.sqlite
                                                                                                                                                                                                                  • Size 512KB
                                                                                                                                                                                                                  • SHA256 25e5ed645e257070269d388f427d85038899a3d2cc4a11d3505c661a0e9cf574
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  store.json.mozlz4.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\crashes\store.json.mozlz4.tmp
                                                                                                                                                                                                                  • Size 66B
                                                                                                                                                                                                                  • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  data.safe.bin
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\datareporting\glean\db\data.safe.bin
                                                                                                                                                                                                                  • Size 182B
                                                                                                                                                                                                                  • SHA256 86bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  state.json
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\datareporting\state.json
                                                                                                                                                                                                                  • Size 51B
                                                                                                                                                                                                                  • SHA256 4a3a666d98e61b5fe06fecac56807137a0fffb4bb71d4c3b16baa8702dde738c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  favicons.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\favicons.sqlite
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 f4ac1304a23eed725bbcf475cfec19f51d0d8b49c6bcc36bbdf66427ce824313
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  formhistory.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\formhistory.sqlite
                                                                                                                                                                                                                  • Size 256KB
                                                                                                                                                                                                                  • SHA256 68e855f415c5b86407472768dfa996e8562bde175d654b645cd312d5e8e8595a
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  permissions.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\permissions.sqlite
                                                                                                                                                                                                                  • Size 96KB
                                                                                                                                                                                                                  • SHA256 fe4ef3ec9c44e17f0d7cd0cabf1a7637b539c8f3601be30d92375dced0dddf63
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  places.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\places.sqlite
                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                  • SHA256 3a58f832a0e5d5253ee6e28eb4eaa134880fa5719bf7dbda1cd92a0234e221c0
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js
                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                  • SHA256 dbe9e528aa6b9c843e7b43c731d27f482124fb895e68dcae193e9704cc468fad
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js
                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                  • SHA256 690ff02c309eeaea8c35823d4e86fb267932565c3eb313831d6240a960ade68c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js
                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                  • SHA256 2dc275d572c019a4539a06cb5f1e8037fc414c5b6896a673e798d799bae230df
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js
                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                  • SHA256 8d4cc915c85103a2de2b0d853c2ead502840ace8dc89da5357ef88d6993a48df
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js
                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                  • SHA256 66433e8ed05097f14db91d38f2262fa6397f2c5de63156c0ff82412923c0ed52
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  prefs-1.js
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\prefs-1.js
                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                  • SHA256 7f1a3e89b4a67b246fd53f3b35abdd6d51faa707c19d8d71288e36000b227713
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  protections.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\protections.sqlite
                                                                                                                                                                                                                  • Size 64KB
                                                                                                                                                                                                                  • SHA256 890033ea279f13478e655150a823a5f84176d2f8f2ec3724dc61dfec775707c4
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  sessionCheckpoints.json
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionCheckpoints.json
                                                                                                                                                                                                                  • Size 288B
                                                                                                                                                                                                                  • SHA256 2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Size 122B
                                                                                                                                                                                                                  • SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Size 53B
                                                                                                                                                                                                                  • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Size 90B
                                                                                                                                                                                                                  • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionCheckpoints.json.tmp
                                                                                                                                                                                                                  • Size 259B
                                                                                                                                                                                                                  • SHA256 4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                  • SHA256 f2d3d3529bd58fa1de475117abe263ece70ca0d384172c150155b78ed898c26c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                  • SHA256 6712975548903792f98aa9ee8af3bcb6eee6fa9ed4a38e8116f85e33a5031181
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                  • SHA256 419f3d5c31fd387ce996349fce640ae4f0a3d4a198e01e3c904c2384df4c3470
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 11KB
                                                                                                                                                                                                                  • SHA256 24f483cdd71a7085bb9e57ceab85e6b30613d55b0dec7494200529860014240b
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                  • SHA256 72c91c8559391918279b4ba7f9652430300d42565669b0b9e6044a78f4079f88
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                  • SHA256 b35e0b490914273777a1aff5c8ed7f3c18c0c287d233f9cda0299d6a5b7f33ec
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                  • SHA256 27430901565b0098ce00cd0ea5c23e3372e7d6f4589c295de60c6d911dfb0990
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  recovery.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                  • SHA256 9794478595062ef7a92fdc72ca70d94cacc9af6a9cb51c37e1a728d5a977eeb4
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  sessionstore.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore.jsonlz4
                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                  • SHA256 4be52032d63213664295d688e29085951e2cf5de567228f33182c96dff2d490a
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  sessionstore.jsonlz4
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\sessionstore.jsonlz4
                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                  • SHA256 fe84e5b02084038356f08ea92b5288ac7461527d47755fc9bbfb04ca6d152059
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  storage.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\storage.sqlite
                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                  • SHA256 006e1065b1a8dde221e4435aef2f8216a6483adeef235ce0d71e0679da91c535
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  data.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\storage\default\https+++www.google.com\ls\data.sqlite
                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                  • SHA256 b3cf7ce9f77b1537c2c527b1c93eea259068173df84a161e8dec578b6c11a588
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  1657114595AmcateirvtiSty.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
                                                                                                                                                                                                                  • Size 48KB
                                                                                                                                                                                                                  • SHA256 8255bcbf93339e0985dee7014931529aaaff267100ce754ccd268843b5d49618
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                  • Size 200KB
                                                                                                                                                                                                                  • SHA256 2d6db9d0db504195043c79bdd2821f33fe2ae94b032ca95a7dd52ae69fa8f087
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  xulstore.json
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\xulstore.json
                                                                                                                                                                                                                  • Size 217B
                                                                                                                                                                                                                  • SHA256 e881d3d030d2427dd30d05df4e5bf1494af4e14c5440e20772757dd197626d46
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  xulstore.json.tmp
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bov3gdb6.default-release\xulstore.json.tmp
                                                                                                                                                                                                                  • Size 141B
                                                                                                                                                                                                                  • SHA256 7e63f727108182d4afdf0ae5131c9e0692d857b934fe8d93a7d4a8cea58fb834
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  Nursultan NextGen Crack.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
                                                                                                                                                                                                                  • Size 135KB
                                                                                                                                                                                                                  • SHA256 f46d7ae8973b42a0cb892c6aa8d6a559b4cc1d0c67b1d5df3072c4f7f77b53fb
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  и.bat
                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\и.bat
                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                  • SHA256 6a218880f23edb2a809ee20919f355f80ef4a0b545c3d79ffa8c848441eced7a
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  aida64extreme730.exe
                                                                                                                                                                                                                  • Path C:\Users\Admin\Downloads\aida64extreme730.exe
                                                                                                                                                                                                                  • Size 49.8MB
                                                                                                                                                                                                                  • SHA256 d55b721e6c85ec11790be00680b37bd0e8886cebc41bb5ce64175fc12ce8f064
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  aida64extreme730.exe:Zone.Identifier
                                                                                                                                                                                                                  • Path C:\Users\Admin\Downloads\aida64extreme730.exe:Zone.Identifier
                                                                                                                                                                                                                  • Size 122B
                                                                                                                                                                                                                  • SHA256 735354b9e98de70f1128b580c9b75008a2452455ebd8cb499820007f2e6621fd
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  memory/32-457-0x000000001B5B0000-0x000000001B5B9000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-64-0x000000001B130000-0x000000001B13C000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-458-0x000000001B5E0000-0x000000001B5ED000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-460-0x000000001B610000-0x000000001B61B000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-394-0x000000001B670000-0x000000001B6FE000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-1028-0x000000001B730000-0x000000001B73A000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-19-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-456-0x000000001B560000-0x000000001B5A6000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-17-0x0000000000300000-0x0000000000326000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-2230-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-1557-0x000000001BCA0000-0x000000001BCAC000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-515-0x000000001B700000-0x000000001B70A000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-63-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-459-0x000000001B5F0000-0x000000001B60E000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-494-0x000000001B640000-0x000000001B64A000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-65-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-69-0x00007FFBE9C70000-0x00007FFBEA732000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-194-0x000000001BEF0000-0x000000001BF5A000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-476-0x000000001B560000-0x000000001B5A6000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-284-0x000000001BDE0000-0x000000001BDEE000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/32-83-0x0000000000C10000-0x0000000000C1A000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3092-0-0x00007FFBE9C73000-0x00007FFBE9C75000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3092-1-0x0000000000340000-0x000000000037A000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3484-1559-0x0000000000400000-0x0000000004EFC000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/3484-1532-0x0000000000400000-0x0000000004EFC000-memory.dmp
                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                  memory/4800-25-0x000001BD7ECF0000-0x000001BD7ED12000-memory.dmp
                                                                                                                                                                                                                  Download