Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
890s -
max time network
890s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 16:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1254454882648195082/1254484147880202280/LunaExec.rar?ex=667ba328&is=667a51a8&hm=7803d134dee86f4bba1a7303fba75a8ca5e0d64bc5319ec40abe75f874cd273e&
Resource
win10v2004-20240611-en
General
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Klix.exe Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Klix.exe Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Klix.exe Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Klix.exe Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Klix.exe -
Executes dropped EXE 35 IoCs
pid Process 5620 LunaExec.exe 5140 Klix.exe 5740 Klix.exe 5424 Klix.exe 8968 LunaExec.exe 11588 Klix.exe 10248 Klix.exe 7544 Klix.exe 8804 LunaExec.exe 5548 Klix.exe 8592 Klix.exe 11948 Klix.exe 11636 Klix.exe 10400 Klix.exe 5940 Klix.exe 7424 winrar-x64-701.exe 5944 winrar-x64-701.exe 3288 LunaExec.exe 5328 Klix.exe 7664 Klix.exe 3668 Klix.exe 5184 Klix.exe 3724 Klix.exe 7496 Klix.exe 4580 Process not Found 10300 Process not Found 7492 Process not Found 1384 Process not Found 12404 Process not Found 8912 Process not Found 9036 Process not Found 10356 Process not Found 12128 Process not Found 9792 Process not Found 6464 Process not Found -
Loads dropped DLL 64 IoCs
pid Process 5620 LunaExec.exe 5620 LunaExec.exe 5620 LunaExec.exe 5140 Klix.exe 5140 Klix.exe 5140 Klix.exe 5140 Klix.exe 5740 Klix.exe 5740 Klix.exe 5740 Klix.exe 5740 Klix.exe 5740 Klix.exe 5424 Klix.exe 8968 LunaExec.exe 8968 LunaExec.exe 8968 LunaExec.exe 8968 LunaExec.exe 11588 Klix.exe 11588 Klix.exe 11588 Klix.exe 11588 Klix.exe 10248 Klix.exe 10248 Klix.exe 10248 Klix.exe 10248 Klix.exe 10248 Klix.exe 7544 Klix.exe 8804 LunaExec.exe 8804 LunaExec.exe 8804 LunaExec.exe 8804 LunaExec.exe 5548 Klix.exe 5548 Klix.exe 5548 Klix.exe 5548 Klix.exe 8592 Klix.exe 8592 Klix.exe 8592 Klix.exe 8592 Klix.exe 8592 Klix.exe 11948 Klix.exe 11636 Klix.exe 11636 Klix.exe 11636 Klix.exe 1548 taskmgr.exe 10400 Klix.exe 10400 Klix.exe 10400 Klix.exe 10400 Klix.exe 10400 Klix.exe 1548 taskmgr.exe 1548 taskmgr.exe 5940 Klix.exe 1548 taskmgr.exe 1548 taskmgr.exe 3288 LunaExec.exe 3288 LunaExec.exe 3288 LunaExec.exe 5328 Klix.exe 5328 Klix.exe 5328 Klix.exe 5328 Klix.exe 7664 Klix.exe 7664 Klix.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 145 discord.com 356 discord.com 172 raw.githubusercontent.com 216 discord.com 316 discord.com 318 discord.com 351 discord.com 114 raw.githubusercontent.com 139 discord.com 132 discord.com 210 discord.com 212 discord.com 215 discord.com 313 discord.com 185 discord.com 324 discord.com 130 discord.com 137 discord.com 171 raw.githubusercontent.com 112 raw.githubusercontent.com 143 discord.com 193 raw.githubusercontent.com 202 raw.githubusercontent.com 354 discord.com 355 discord.com 108 raw.githubusercontent.com 320 discord.com 339 raw.githubusercontent.com 223 discord.com 224 raw.githubusercontent.com 317 discord.com 346 discord.com 182 discord.com 203 raw.githubusercontent.com 306 raw.githubusercontent.com 358 raw.githubusercontent.com 133 discord.com 177 discord.com 142 discord.com 183 discord.com 188 discord.com 308 raw.githubusercontent.com 322 discord.com 134 discord.com 170 raw.githubusercontent.com 191 discord.com 213 discord.com 302 raw.githubusercontent.com 305 raw.githubusercontent.com 357 discord.com 107 raw.githubusercontent.com 111 raw.githubusercontent.com 136 discord.com 327 discord.com 353 discord.com 325 discord.com 201 raw.githubusercontent.com 218 discord.com 338 raw.githubusercontent.com 350 discord.com 167 raw.githubusercontent.com 173 raw.githubusercontent.com 186 discord.com 220 discord.com -
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 98 ipinfo.io 301 ipinfo.io 162 ipinfo.io 199 ipinfo.io 300 ipinfo.io 333 ipinfo.io 334 ipinfo.io 99 ipinfo.io 161 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 53 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Klix.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Klix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Detects videocard installed 1 TTPs 5 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 8936 WMIC.exe 10772 WMIC.exe 9692 Process not Found 8428 WMIC.exe 10876 WMIC.exe -
Enumerates processes with tasklist 1 TTPs 64 IoCs
pid Process 10264 tasklist.exe 8124 tasklist.exe 10024 tasklist.exe 9548 tasklist.exe 8728 tasklist.exe 8392 tasklist.exe 2208 Process not Found 9244 tasklist.exe 2260 tasklist.exe 12460 tasklist.exe 7960 tasklist.exe 9496 tasklist.exe 9808 tasklist.exe 8720 tasklist.exe 1568 tasklist.exe 8792 tasklist.exe 9856 tasklist.exe 9336 tasklist.exe 11052 tasklist.exe 10152 Process not Found 9792 Process not Found 8728 tasklist.exe 6836 tasklist.exe 4620 tasklist.exe 9308 tasklist.exe 9324 tasklist.exe 748 tasklist.exe 1328 Process not Found 9596 tasklist.exe 9672 tasklist.exe 8236 tasklist.exe 1088 tasklist.exe 10576 Process not Found 9500 tasklist.exe 4280 Process not Found 9516 tasklist.exe 4872 tasklist.exe 3048 tasklist.exe 7332 tasklist.exe 10180 tasklist.exe 8852 tasklist.exe 4964 tasklist.exe 7056 tasklist.exe 632 tasklist.exe 7764 Process not Found 5816 tasklist.exe 3676 Process not Found 8876 tasklist.exe 2268 Process not Found 10204 tasklist.exe 9300 tasklist.exe 8752 tasklist.exe 7676 tasklist.exe 10920 tasklist.exe 1636 tasklist.exe 9156 tasklist.exe 2332 tasklist.exe 4260 tasklist.exe 2876 tasklist.exe 3764 tasklist.exe 8008 Process not Found 6756 tasklist.exe 10896 tasklist.exe 11908 tasklist.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings Process not Found Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 taskmgr.exe -
NTFS ADS 3 IoCs
description ioc Process File created C:\Users\Admin\Downloads\LunaExec.rar:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\winrar-x64-701.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\winrar-x32-701.exe:Zone.Identifier Process not Found -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5188 Process not Found -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 5140 Klix.exe 5140 Klix.exe 5140 Klix.exe 5140 Klix.exe 5140 Klix.exe 5140 Klix.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 8664 powershell.exe 8664 powershell.exe 8664 powershell.exe 1548 taskmgr.exe 12412 powershell.exe 12412 powershell.exe 12412 powershell.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 12660 OpenWith.exe 1548 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3548 firefox.exe Token: SeDebugPrivilege 3548 firefox.exe Token: SeDebugPrivilege 3548 firefox.exe Token: SeRestorePrivilege 4932 7zG.exe Token: 35 4932 7zG.exe Token: SeSecurityPrivilege 4932 7zG.exe Token: SeSecurityPrivilege 4932 7zG.exe Token: SeDebugPrivilege 1548 taskmgr.exe Token: SeSystemProfilePrivilege 1548 taskmgr.exe Token: SeCreateGlobalPrivilege 1548 taskmgr.exe Token: SeSecurityPrivilege 5620 LunaExec.exe Token: SeDebugPrivilege 5760 tasklist.exe Token: SeIncreaseQuotaPrivilege 1864 WMIC.exe Token: SeSecurityPrivilege 1864 WMIC.exe Token: SeTakeOwnershipPrivilege 1864 WMIC.exe Token: SeLoadDriverPrivilege 1864 WMIC.exe Token: SeSystemProfilePrivilege 1864 WMIC.exe Token: SeSystemtimePrivilege 1864 WMIC.exe Token: SeProfSingleProcessPrivilege 1864 WMIC.exe Token: SeIncBasePriorityPrivilege 1864 WMIC.exe Token: SeCreatePagefilePrivilege 1864 WMIC.exe Token: SeBackupPrivilege 1864 WMIC.exe Token: SeRestorePrivilege 1864 WMIC.exe Token: SeShutdownPrivilege 1864 WMIC.exe Token: SeDebugPrivilege 1864 WMIC.exe Token: SeSystemEnvironmentPrivilege 1864 WMIC.exe Token: SeRemoteShutdownPrivilege 1864 WMIC.exe Token: SeUndockPrivilege 1864 WMIC.exe Token: SeManageVolumePrivilege 1864 WMIC.exe Token: 33 1864 WMIC.exe Token: 34 1864 WMIC.exe Token: 35 1864 WMIC.exe Token: 36 1864 WMIC.exe Token: SeIncreaseQuotaPrivilege 1864 WMIC.exe Token: SeSecurityPrivilege 1864 WMIC.exe Token: SeTakeOwnershipPrivilege 1864 WMIC.exe Token: SeLoadDriverPrivilege 1864 WMIC.exe Token: SeSystemProfilePrivilege 1864 WMIC.exe Token: SeSystemtimePrivilege 1864 WMIC.exe Token: SeProfSingleProcessPrivilege 1864 WMIC.exe Token: SeIncBasePriorityPrivilege 1864 WMIC.exe Token: SeCreatePagefilePrivilege 1864 WMIC.exe Token: SeBackupPrivilege 1864 WMIC.exe Token: SeRestorePrivilege 1864 WMIC.exe Token: SeShutdownPrivilege 1864 WMIC.exe Token: SeDebugPrivilege 1864 WMIC.exe Token: SeSystemEnvironmentPrivilege 1864 WMIC.exe Token: SeRemoteShutdownPrivilege 1864 WMIC.exe Token: SeUndockPrivilege 1864 WMIC.exe Token: SeManageVolumePrivilege 1864 WMIC.exe Token: 33 1864 WMIC.exe Token: 34 1864 WMIC.exe Token: 35 1864 WMIC.exe Token: 36 1864 WMIC.exe Token: SeShutdownPrivilege 5140 Klix.exe Token: SeCreatePagefilePrivilege 5140 Klix.exe Token: SeDebugPrivilege 7780 tasklist.exe Token: SeDebugPrivilege 8324 tasklist.exe Token: SeDebugPrivilege 8152 tasklist.exe Token: SeShutdownPrivilege 5140 Klix.exe Token: SeCreatePagefilePrivilege 5140 Klix.exe Token: SeDebugPrivilege 8924 tasklist.exe Token: SeDebugPrivilege 8736 tasklist.exe Token: SeDebugPrivilege 8764 tasklist.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3548 firefox.exe 3548 firefox.exe 3548 firefox.exe 3548 firefox.exe 4932 7zG.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3548 firefox.exe 3548 firefox.exe 3548 firefox.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe 1548 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3548 firefox.exe 3548 firefox.exe 3548 firefox.exe 3548 firefox.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 12660 OpenWith.exe 10728 OpenWith.exe 10728 OpenWith.exe 10728 OpenWith.exe 10728 OpenWith.exe 10728 OpenWith.exe 11604 firefox.exe 11604 firefox.exe 11604 firefox.exe 11604 firefox.exe 7424 winrar-x64-701.exe 7424 winrar-x64-701.exe 7424 winrar-x64-701.exe 5944 winrar-x64-701.exe 5944 winrar-x64-701.exe 5944 winrar-x64-701.exe 12128 Process not Found 12128 Process not Found 12128 Process not Found 6600 Process not Found 6600 Process not Found 6600 Process not Found 6600 Process not Found 9792 Process not Found 9792 Process not Found 9792 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 928 wrote to memory of 3548 928 firefox.exe 82 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 2232 3548 firefox.exe 83 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 PID 3548 wrote to memory of 1972 3548 firefox.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1254454882648195082/1254484147880202280/LunaExec.rar?ex=667ba328&is=667a51a8&hm=7803d134dee86f4bba1a7303fba75a8ca5e0d64bc5319ec40abe75f874cd273e&"1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1254454882648195082/1254484147880202280/LunaExec.rar?ex=667ba328&is=667a51a8&hm=7803d134dee86f4bba1a7303fba75a8ca5e0d64bc5319ec40abe75f874cd273e&2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3548.0.970205849\2126779474" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c69e4de-6329-446b-a9eb-eb7ad6a7246a} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" 1856 26f70109a58 gpu3⤵PID:2232
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3548.1.1984432758\1078776239" -parentBuildID 20230214051806 -prefsHandle 2476 -prefMapHandle 2472 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baf8ee96-8c34-4251-a579-ac6198e7dc08} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" 2488 26f5be8ee58 socket3⤵PID:1972
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3548.2.1094151630\77546506" -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 2996 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 956 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe893a4d-4928-4b99-af2c-ddbe33d47326} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" 2912 26f73128558 tab3⤵PID:3744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3548.3.992081676\1125779324" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 956 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83bfb02f-95a2-488f-b55d-89c0fe5f2fda} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" 3628 26f74b3f758 tab3⤵PID:3652
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3548.4.532220010\1587383920" -childID 3 -isForBrowser -prefsHandle 5336 -prefMapHandle 5392 -prefsLen 27656 -prefMapSize 235121 -jsInitHandle 956 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3cbbf95-2424-4ac8-a52b-a3f27aed842e} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" 5396 26f770a7258 tab3⤵PID:2920
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3548.5.1243307347\2030148448" -childID 4 -isForBrowser -prefsHandle 5476 -prefMapHandle 5368 -prefsLen 27656 -prefMapSize 235121 -jsInitHandle 956 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5947fb33-23c7-4d96-846c-d50c458af9e4} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" 5364 26f77458e58 tab3⤵PID:4528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3548.6.236585115\2033284335" -childID 5 -isForBrowser -prefsHandle 5708 -prefMapHandle 5512 -prefsLen 27656 -prefMapSize 235121 -jsInitHandle 956 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc4937e-d8e8-496b-b26d-212f308ab9a3} 3548 "\\.\pipe\gecko-crash-server-pipe.3548" 5696 26f7745b858 tab3⤵PID:3424
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4040
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap29992:78:7zEvent44421⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4932
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1548
-
C:\Users\Admin\Downloads\LunaExec.exe"C:\Users\Admin\Downloads\LunaExec.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exeC:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5140 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5364
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5760
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1576 --field-trial-handle=1700,i,11151671405708262379,1540931990199708391,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5740
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --mojo-platform-channel-handle=2012 --field-trial-handle=1700,i,11151671405708262379,1540931990199708391,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5424
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5140 get ExecutablePath"3⤵PID:5556
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5140 get ExecutablePath4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6140
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Suspicious use of AdjustPrivilegeToken
PID:7780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5048
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Suspicious use of AdjustPrivilegeToken
PID:8152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:544
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Suspicious use of AdjustPrivilegeToken
PID:8324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6000
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Suspicious use of AdjustPrivilegeToken
PID:8924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5960
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6004
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6064
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Suspicious use of AdjustPrivilegeToken
PID:8764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5796
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5168
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1488
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8704
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6072
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9164
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6104
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6084
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6060
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5964
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5756
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5480
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5204
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5448
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5428
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5368
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3960
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1396
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6128
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5648
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5844
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5768
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6092
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5968
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6156
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Suspicious use of AdjustPrivilegeToken
PID:8736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6224
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6236
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6244
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6284
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6296
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6308
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6324
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6340
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6352
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6368
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6380
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6392
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6408
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6420
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6432
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6448
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6472
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6648
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6664
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6672
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6692
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10008
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6812
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6824
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6840
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6860
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6876
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6884
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6896
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5364
-
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:10264
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6912
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6924
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6932
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6944
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10164
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6952
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6960
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7020
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7032
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7060
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7076
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7212
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7228
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7244
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7268
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7276
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7296
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7308
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7320
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7328
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7336
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7344
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7368
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:10024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7380
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7396
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7412
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7420
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7432
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7440
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7448
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9324
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7460
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7468
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7476
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:10204
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7488
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"3⤵PID:7496
-
C:\Windows\system32\net.exenet session4⤵PID:9920
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:10788
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"3⤵PID:7768
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:10100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"3⤵PID:7792
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption, osarchitecture4⤵PID:9784
-
-
C:\Windows\system32\more.commore +14⤵PID:10256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"3⤵PID:11656
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:8372
-
-
C:\Windows\system32\more.commore +14⤵PID:7768
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"3⤵PID:10468
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController get name4⤵
- Detects videocard installed
PID:8428
-
-
C:\Windows\system32\more.commore +14⤵PID:11488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:8372
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:8664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"3⤵PID:12372
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName4⤵
- Suspicious behavior: EnumeratesProcesses
PID:12412
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12548
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5140 get ExecutablePath"3⤵PID:13112
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5140 get ExecutablePath4⤵PID:13152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\oAWVFZmtkga7.vbs"3⤵PID:13216
-
C:\Windows\system32\cscript.execscript C:\Users\Admin\AppData\Roaming\oAWVFZmtkga7.vbs4⤵PID:13300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""3⤵PID:13224
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"4⤵PID:10632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4996
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:5584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4876
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:12760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12812
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:1568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"3⤵PID:8152
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵PID:8712
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 --field-trial-handle=1700,i,11151671405708262379,1540931990199708391,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:11636
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:12660
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\LunaExec.rar"1⤵PID:5400
-
C:\Users\Admin\Downloads\LunaExec.exe"C:\Users\Admin\Downloads\LunaExec.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8968 -
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exeC:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:11588 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1252
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12968
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1784,i,10148250847160189700,2717606826323809920,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:10248
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --mojo-platform-channel-handle=1972 --field-trial-handle=1784,i,10148250847160189700,2717606826323809920,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5140 get ExecutablePath"3⤵PID:7424
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5140 get ExecutablePath4⤵PID:11796
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7900
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11432
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10680
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11508
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9088
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7936
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9196
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11420
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9908
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10448
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7460
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8596
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8112
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9032
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12056
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9212
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7068
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10464
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8212
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8880
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9048
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13020
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8660
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:12460
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7756
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:5816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7064
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:4964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7748
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11976
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11064
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8020
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9644
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8024
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7740
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9000
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:3048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11220
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9004
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12160
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11944
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11360
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5836
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6556
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11464
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10644
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10568
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6312
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7508
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5892
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9144
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6612
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5820
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10808
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13060
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10648
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9700
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11780
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10052
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9436
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9320
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:4260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7660
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5224
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6936
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8684
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5524
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13076
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5476
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11696
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11080
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11736
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6276
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:4872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8948
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13104
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6424
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6904
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7688
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13124
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:2332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9600
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9500
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6096
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13168
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6536
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8624
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8864
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6064
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3080
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13212
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6232
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13252
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13272
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7856
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9188
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11404
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:6756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9996
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9992
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5472
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9896
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13196
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"3⤵PID:10896
-
C:\Windows\system32\net.exenet session4⤵PID:8584
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:12800
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"3⤵PID:8576
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"3⤵PID:11216
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption, osarchitecture4⤵PID:12668
-
-
C:\Windows\system32\more.commore +14⤵PID:12740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"3⤵PID:1768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:5036
-
-
C:\Windows\system32\more.commore +14⤵PID:2012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"3⤵PID:3464
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController get name4⤵
- Detects videocard installed
PID:10876
-
-
C:\Windows\system32\more.commore +14⤵PID:4224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:3112
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵PID:1904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"3⤵PID:3924
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName4⤵PID:4316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6236
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5140 get ExecutablePath"3⤵PID:8244
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5140 get ExecutablePath4⤵PID:4128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\PtDNd3pqu7cJ.vbs"3⤵PID:1392
-
C:\Windows\system32\cscript.execscript C:\Users\Admin\AppData\Roaming\PtDNd3pqu7cJ.vbs4⤵PID:4444
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""3⤵PID:12704
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"4⤵PID:4076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2208
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:11760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:2944
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:10780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10236
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"3⤵PID:2516
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵PID:7108
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --mojo-platform-channel-handle=2236 --field-trial-handle=1784,i,10148250847160189700,2717606826323809920,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5940
-
-
-
C:\Users\Admin\Downloads\LunaExec.exe"C:\Users\Admin\Downloads\LunaExec.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8804 -
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exeC:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5548 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12788
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7968
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1792,i,3755188772804263383,9973567179446677850,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8592
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --mojo-platform-channel-handle=1976 --field-trial-handle=1792,i,3755188772804263383,9973567179446677850,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
PID:11948
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5140 get ExecutablePath"3⤵PID:7184
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5140 get ExecutablePath4⤵PID:10592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8864
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6712
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12488
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6828
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10884
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1936
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10564
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8892
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8752
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10272
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8912
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8524
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:10180
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9088
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9908
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13028
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5848
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6320
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:11052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10912
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12948
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7264
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7520
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9776
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10268
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:1088
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7196
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2648
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5068
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7584
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7560
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8580
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10668
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5972
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5284
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10400
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5524
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10684
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6704
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10084
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6884
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13304
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:7676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8904
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9244
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7172
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7576
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5572
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12648
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7396
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6528
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8620
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9468
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2172
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6788
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9368
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4148
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13212
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7796
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10752
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9964
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7532
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11084
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6496
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13192
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11560
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6296
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10128
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:7332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7064
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11368
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6140
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8716
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:6836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11728
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:7056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1348
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12504
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12512
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11404
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10420
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10320
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4044
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7656
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9072
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11016
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4540
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6080
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:11908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9896
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6128
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:9500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11596
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10208
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11248
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11300
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11556
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5564
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9560
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6900
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12940
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"3⤵PID:9228
-
C:\Windows\system32\net.exenet session4⤵PID:3260
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:8032
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"3⤵PID:7912
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"3⤵PID:9412
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption, osarchitecture4⤵PID:12836
-
-
C:\Windows\system32\more.commore +14⤵PID:5820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"3⤵PID:11768
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:5588
-
-
C:\Windows\system32\more.commore +14⤵PID:9948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"3⤵PID:2128
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController get name4⤵
- Detects videocard installed
PID:8936
-
-
C:\Windows\system32\more.commore +14⤵PID:11708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:10004
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵PID:11776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"3⤵PID:5312
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName4⤵PID:11940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12508
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5140 get ExecutablePath"3⤵PID:1188
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5140 get ExecutablePath4⤵PID:10032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\VFUtmB5leAim.vbs"3⤵PID:8712
-
C:\Windows\system32\cscript.execscript C:\Users\Admin\AppData\Roaming\VFUtmB5leAim.vbs4⤵PID:1476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""3⤵PID:7408
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"4⤵PID:12660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:1328
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:9536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:12836
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:11164
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2908
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"3⤵PID:7916
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵PID:4204
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1568 --field-trial-handle=1792,i,3755188772804263383,9973567179446677850,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:10400
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:10728
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:4936
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:11604 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.0.1074111553\58669168" -parentBuildID 20230214051806 -prefsHandle 1744 -prefMapHandle 1736 -prefsLen 22534 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b0ea59d-9d90-4747-b4cb-6c1e8b0ec48c} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 1836 16cc399ce58 gpu3⤵PID:4252
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.1.497864892\1104407323" -parentBuildID 20230214051806 -prefsHandle 2376 -prefMapHandle 2364 -prefsLen 22570 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c658f692-0592-4811-9772-b2ff3ada1e2f} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 2404 16cb6b89f58 socket3⤵PID:10444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.2.8233055\1509674769" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2888 -prefsLen 22608 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1ad2b09-b3aa-43e1-a355-355cdef57026} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 2984 16cc6715d58 tab3⤵PID:6968
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.3.1573105194\1655828236" -childID 2 -isForBrowser -prefsHandle 1036 -prefMapHandle 1032 -prefsLen 27202 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2805601-41e4-4890-985b-9064eb11e327} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 3488 16cc7c7e658 tab3⤵PID:10080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.4.162605347\1319491739" -childID 3 -isForBrowser -prefsHandle 4048 -prefMapHandle 4044 -prefsLen 27202 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c7ec577-758f-4a60-b127-647aed4596ee} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 4032 16cc7c7c558 tab3⤵PID:4348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.5.655933477\1671981660" -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 5156 -prefsLen 28017 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cd42e32-f0ce-4689-b387-03cc0f2cf023} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 5144 16cca037e58 tab3⤵PID:9952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.6.684822055\584039208" -childID 5 -isForBrowser -prefsHandle 5380 -prefMapHandle 5376 -prefsLen 28017 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffce0f09-eb9b-47e2-bb87-ebdc3a9832fa} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 5388 16cca038158 tab3⤵PID:3208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.7.472622248\606381010" -childID 6 -isForBrowser -prefsHandle 5524 -prefMapHandle 5528 -prefsLen 28017 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b60fc458-6d44-4b96-bf30-3636ef3484d2} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 5516 16cca03a858 tab3⤵PID:11772
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="11604.8.134376637\1255839349" -childID 7 -isForBrowser -prefsHandle 4664 -prefMapHandle 4648 -prefsLen 28096 -prefMapSize 235121 -jsInitHandle 1268 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {584f120d-0307-4b98-9bf2-0e41110fa758} 11604 "\\.\pipe\gecko-crash-server-pipe.11604" 4248 16cc3e85458 tab3⤵PID:13272
-
-
C:\Users\Admin\Downloads\winrar-x64-701.exe"C:\Users\Admin\Downloads\winrar-x64-701.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7424
-
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\84ae3a59f2824a13a9cb7d5f106e854f /t 13044 /p 74241⤵PID:8168
-
C:\Users\Admin\Downloads\winrar-x64-701.exe"C:\Users\Admin\Downloads\winrar-x64-701.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5944
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\10521b94e0044e5ca0917d26838f2475 /t 8340 /p 59441⤵PID:12948
-
C:\Users\Admin\Downloads\LunaExec.exe"C:\Users\Admin\Downloads\LunaExec.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exeC:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5328 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4856
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:7960
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1712,i,8810424413873189056,12654269116684900573,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7664
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --mojo-platform-channel-handle=1972 --field-trial-handle=1712,i,8810424413873189056,12654269116684900573,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
PID:3668
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5328 get ExecutablePath"3⤵PID:6956
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5328 get ExecutablePath4⤵PID:8400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9876
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3036
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5720
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9736
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1328
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3480
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5816
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9524
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6636
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8920
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10812
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10508
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6768
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12608
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6876
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7016
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12700
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8300
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9240
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:10920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12836
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:2064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6504
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5808
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2452
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5224
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2908
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6644
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2736
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11292
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1524
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12600
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3164
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9204
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11404
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7916
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3544
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10616
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10576
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10392
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12208
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8848
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:9920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4700
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7748
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12732
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11116
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8720
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7828
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:4620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5616
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4712
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2008
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:2876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3064
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4024
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4160
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9396
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1624
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8064
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8068
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5904
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6808
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2192
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9032
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11412
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13200
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3496
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7844
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2332
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9704
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7204
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10972
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7824
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:8016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8908
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4920
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4704
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11572
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7444
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13188
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:6572
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:5548
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6140
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7072
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2352
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10900
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4296
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:8876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11000
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12588
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:2016
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8912
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:13208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9084
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1676
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:1636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13252
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3212
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:8236
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:1092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4216
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7332
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:1616
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:7040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12528
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:12848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:13244
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:5420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:9716
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:11960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:12664
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:6608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:11260
-
C:\Windows\system32\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:3764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:4372
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:3408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:3728
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:4636
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"3⤵PID:9244
-
C:\Windows\system32\net.exenet session4⤵PID:12628
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:4716
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"3⤵PID:8800
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"3⤵PID:5232
-
C:\Windows\System32\Wbem\WMIC.exewmic OS get caption, osarchitecture4⤵PID:1220
-
-
C:\Windows\system32\more.commore +14⤵PID:7300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"3⤵PID:7992
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵PID:7528
-
-
C:\Windows\system32\more.commore +14⤵PID:9488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"3⤵PID:11084
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController get name4⤵
- Detects videocard installed
PID:10772
-
-
C:\Windows\system32\more.commore +14⤵PID:5228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:11656
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵PID:9136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName"3⤵PID:13116
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName4⤵PID:3192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:10960
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5328 get ExecutablePath"3⤵PID:13220
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5328 get ExecutablePath4⤵PID:11680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cscript C:\Users\Admin\AppData\Roaming\WAxphG26Coxa.vbs"3⤵PID:6760
-
C:\Windows\system32\cscript.execscript C:\Users\Admin\AppData\Roaming\WAxphG26Coxa.vbs4⤵PID:10852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""3⤵PID:4728
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"4⤵PID:7820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:12844
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:6736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:5108
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵PID:12392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"3⤵PID:7264
-
C:\Windows\system32\tasklist.exetasklist4⤵PID:10424
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f"3⤵PID:11084
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵PID:4808
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
PID:5184 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4452
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:10896
-
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1804,i,17845880193043111694,1500359971891759243,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Executes dropped EXE
PID:3724
-
-
C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe"C:\Users\Admin\AppData\Local\Temp\2iHnfrPugJ2DbMeU11r3ujFqngy\Klix.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Klix" --mojo-platform-channel-handle=1988 --field-trial-handle=1804,i,17845880193043111694,1500359971891759243,131072 --disable-features=BlinkSchedulerMicroTaskQueuePerWindowAgent,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Executes dropped EXE
PID:7496
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic process where processid=5328 get ExecutablePath"2⤵PID:12896
-
C:\Windows\System32\Wbem\WMIC.exewmic process where processid=5328 get ExecutablePath3⤵PID:11784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10588
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7308
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:9368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:9388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7320
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:6576
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10768
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7868
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10720
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:11904
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4100
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:11012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:11676
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:9552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:12964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:9672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:12080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:12660
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:12692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10252
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:12652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:436
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7132
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:6124
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4820
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7084
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:11024
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4516
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1956
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:11196
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10124
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:10960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10000
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:6628
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:12028
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:13120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5800
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:6620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8748
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5692
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7504
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4544
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:7960
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:8224
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3260
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:10480
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:6036
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:11924
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:1400
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:9344
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD573bd1e15afb04648c24593e8ba13e983
SHA14dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA5126eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
20KB
MD50729b590e574c28eebebff8d58489c6f
SHA11db1e47a671a0803af3e231742ed1edae908ea2b
SHA256b15e6fc837bf764cfeb2761df86a766660ec25470dbe5c2dcf14dc0b8cd9b6b9
SHA5122353ac1d0443fabe81d81ab9214c1cc12630f6aab46d8351b0c254bbac4ade5172d85d67af8710ec33e410bdfd58328a9600569bb039fbec5d1c2296c57b6761
-
Filesize
100KB
MD545504a732c2261ea90b34d223cc73ea9
SHA14726c7f640a60a2d96cd7c2d7dc347bee38a38b4
SHA25619ca1fc27a0eaaeddb5cc49534603aaa35ea17199b002cfb7af33647b0ef0d6e
SHA51237a2c201ef424e1555bb097aa834e5a83b1c98d57fff71a94ab1bc88e6fd519e35e4a55bd694a914b1257379b9fa241f3d6e4f402dd0517ca565c9300c538711
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
64B
MD53ca1082427d7b2cd417d7c0b7fd95e4e
SHA1b0482ff5b58ffff4f5242d77330b064190f269d3
SHA25631f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f
SHA512bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
1KB
MD5e5ea61f668ad9fe64ff27dec34fe6d2f
SHA15d42aa122b1fa920028b9e9514bd3aeac8f7ff4b
SHA2568f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466
SHA512cb308188323699eaa2903424527bcb40585792f5152aa7ab02e32f94a0fcfe73cfca2c7b3cae73a9df3e307812dbd18d2d50acbbfeb75d87edf1eb83dd109f34
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rfj66zji.default-release\activity-stream.discovery_stream.json.tmp
Filesize27KB
MD5e587cecb4e53083dfd8aa474b4d06a51
SHA1b56ebaf330bebd9fc21ba3d0c5a841ef84815a96
SHA25661d5ef0f8add9a4d7612f6c4c7533fd4850a8f3684bbe48f551b3ad26d134902
SHA51205299bb534161d19241070620e02b59847872e25f44c4cab6d8b75ff503430aac5e9f65ae489fb76c7a525b8e282a966f9b517323a176604f9a620a9e1f37bfc
-
Filesize
9KB
MD59d6a71c32036248ff994a69b40a1f9a1
SHA18c6aeba92b6a0f8543bb63417a73b084ac8e3397
SHA25691495a85d87fbd3a5a550fc196013a92c42d15ae2f1b587101906fac77cda5ed
SHA512103c1db731cfa1ff3a0a368a43999fb57e24499ae7e861b9a4e0188c9c99733080768d96afda88cba7e60e38b76842c01d04c6c0dda60de700136f43c4357d40
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rfj66zji.default-release\cache2\entries\383A97A57B113BD106DE6984E6DBA5F537327263
Filesize13KB
MD535bcaed9cbf345cab56e2eb4273c0fe2
SHA1087d7ad8b905819db9dfef2ddf562cb2421f9bbf
SHA2567217234ee948631be23f077260a20518da46c82d46cd9067ee17e6a50d47f73a
SHA512f6db1562a0445c962b1c8de293e0d2cb34664003dbe2b29efbf3c4f7e8716d9c0df096f1f74dc0d476d5155f6624296739e5b24d0bf23c3394370e01618b8a61
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rfj66zji.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Filesize13KB
MD5d16589d62678908ec31d7d7f17d3df2f
SHA179905f2fc2b6ed8a2b0c53e2a1adac0e22d1a24b
SHA2561877f5b4143f29f0ed29418a5bc7b37c5706f7f64933027842bf94bb7ea6c88e
SHA512431edd4200bef9389d699e94f9b4dd2cc324cc231e68f632e89f691ec31b36484547e0827104c5af54e82d6a297760673fed7052d81360484333a1376d468b8b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rfj66zji.default-release\cache2\entries\79B0DDE3FA8DCB1BD2B4CA2ED3EB8F3088226A6C
Filesize412KB
MD541eca43ac3b90f6804a38da2812ff431
SHA1c02a35d477204c247e10ffb3d27605d466032dd1
SHA2561937cc2eda294382138d2778a1cea3c388747ee5441ea1c7048c650ad04e47c3
SHA5123072892ad2191c71abbce886d1bc35083ec731eefb418b03fbef5b5f057ae814ec261e2759b95cb9cbf80a007b884d86acd4adc5b499c96fd785d352be857ebe
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rfj66zji.default-release\cache2\entries\874F18BED7CB5132715B8A78AD866AC231B4B3F3
Filesize18KB
MD5398eab4d4fe00d8ee9aa4384202c4bfb
SHA1ff21284c04080266495c973fec75f723306d2f9a
SHA256e6c354d348bc0ee167fda73479210a49030da5b42b7a5b0895a47e1bd4b2375c
SHA51255c5b8d5c4fbf6287c28c729f165dfcd61c96f028870ad44f8b702bcb38784506ac0849d1bcfe6cd7aba98073c34eb1b3ccef16b646f32e09054a616b32329b7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\rfj66zji.default-release\jumpListCache\BVO0A92hH_Mvcqcl2ACTDQ==.ico
Filesize660B
MD5180a2c257c44b0c5fc17e711e028e113
SHA1a3820b6c60d3695e7ee23ecc9db84fbf71c98a8f
SHA25663dfb4b8df6f971be76607a5d56d4fa9570f7dafd6bd7c0f0efa3dba163471c9
SHA51267e85cff042f54f62bb5f8afa1f40308bafaa74afbb7e0807269c2f6e4f8385685203fb497f0eb6e95c3f53dc894f3c9ea6bc913731b0f3b688291c6625f38d3
-
Filesize
137KB
MD504bfbfec8db966420fe4c7b85ebb506a
SHA1939bb742a354a92e1dcd3661a62d69e48030a335
SHA256da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA5124ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65
-
Filesize
156KB
MD5e0cd1749f2b60e51c4a542ac459de1a1
SHA1f7f8eb8f751fe9a6fe7be1694b745ef3a6f33b47
SHA2561d0566e952f22a636bca001e14e7abc369c035ce4b699c3f2297b548d7c7dd26
SHA512fe2ff5622afb9ff8111e9aa89e3b74eae88c1939d9e51a2fc94cc0a8373f649adb3b3d68f27be6fbba8ebe20eb28203560f6f7cd0779495895363a8084e7eeab
-
Filesize
126KB
MD58626e1d68e87f86c5b4dabdf66591913
SHA14cd7b0ac0d3f72587708064a7b0a3beca3f7b81c
SHA2562caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59
SHA51203bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99
-
Filesize
1.8MB
MD53072b68e3c226aff39e6782d025f25a8
SHA1cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA2567fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
SHA51261ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
-
Filesize
1KB
MD52500f40c7338d4d783944ad4d861954c
SHA1d7d425c83d4b16a56b006ba0d38d98f6d01bcbca
SHA256456153390c988e1c0f6c77d7685deb3355de28df75de40e168356a29d6a51875
SHA512a0d47d7f768a9e62c9204d2da959eed17beaa144e91e508bc31edb6d967f636b0bea89050b2018b5961b2e83f2acb48ba636019e7219ba64979fe2b6bec7206a
-
Filesize
219B
MD575acb71f114be3a6c4a2e8063234699a
SHA1208132a80fb6e390f93435871bc1599488a05217
SHA256b1e534475bc2288f36efe6d75f662ad04726483abfffde4c2a23cdb6638af852
SHA5128026fa66838ddb971a3f767a0e824f9d37683cf82969c11cc552b68960d9ac39c4ac31c103b2f8905b6537784534a698e9c95c342c219ba4ac4519c704ff7ed9
-
Filesize
95B
MD5b85aae005fbe8d0a63e2e58616ecabd6
SHA116bbb5a0fdd24924f5827801ddfd0003c6e3f48e
SHA256d64ab85eef4da726e3815e051e7e8321afbeb7cad4dd1b874c9a37dd04f4753b
SHA5125d9c54b7bf220c386add8203653166a24db2cd65befda77612a2ca5327eaead4f903a144b53d57d34678f6a8f9a0ec4c542583d32605dc27d8715f76366d0e46
-
Filesize
1KB
MD5ff2efb6e56ef91a2c85425904310293d
SHA13b0ae935ade7410a71dc89113dccf4084b65724d
SHA25602cb39c6b553a7a56dec9a5aa3a80201d17ec4282dd54f354d4bbb7fc157deda
SHA512d3819f519a65011399f0bbc7e75277d88a0075dcabf2fcdc5d1b69f5150835c0f9d6bd0ee4c5c80477bcba54b21580499f3f351245b7269839a42be718371bab
-
Filesize
1KB
MD5188e4aac6312334f30f1169dece969d0
SHA14ebfe7817349cc7be88bea322fc2267048ca9278
SHA25640392ea0ab4a3645616ef07afb5ff70193496dd46e82a527ecf4b72e79b68bcd
SHA51202ef9b2dc384d8dc8da3a427e9391dd8c28ec3a7f0f0a3dcd86db3bb372f38ffffa140bbccd2861306ad1564d9c9787c73bbd9040e51e5ef5d9b82f537fea3d8
-
Filesize
194B
MD5f301bfb2131005383736bd666d527c0b
SHA1b13fd43e790dd9753adac883eb56275925d1e70e
SHA256b7cda6c329d999a29b72368f0edceeff15d9eaf10cf91e52cd6686bb65665398
SHA51209820dc45f7e2e2a598abbf1d212ecebde4023f308d25c44f6d99bc1a7837e639506de3b7dea0a0c47b17075b2617a1335fe4136cae29e16cc7c864fe91d6b7e
-
Filesize
1KB
MD5d2d8973699c90c286c62012f72aac146
SHA167b1fc4d560cc5ab5c35cc84097a9c748724887a
SHA2562fec134ccfe649347e8f885580f8722e2031eb9c6af150311ae0a480517dabc8
SHA5120e5d1b2b5652303de389208ecf9fc44e4c6dd4264e506cbe2db58bfbe698ee797dbfa36e8a5f9d8e155287d9b84fd990771a899343265a85edfad5b1787a83df
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD54d42118d35941e0f664dddbd83f633c5
SHA12b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA2565154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA5123ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
-
Filesize
6.4MB
MD5c3528648bedbde1223a2faab1a3f9af3
SHA1934d3c8f184258338ff380964ed89053ce69ac5b
SHA25657b8e5a3f2cd62805001aefca035c7348b4d1abac157e6df3d798bb31f2ec3d2
SHA5123e3cc0fd7a55f67ee0afff9696beef33bdc9524375bbe9d8e8f7660fd408c756c1156ca0b02ecccdc22799c7b8e74dbde012732ad6b3ebe0a3cfc54ff5132b35
-
Filesize
175KB
MD548515d600258d60019c6b9c6421f79f6
SHA10ef0b44641d38327a360aa6954b3b6e5aab2af16
SHA25607bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce
SHA512b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9
-
Filesize
4.7MB
MD5cb9807f6cf55ad799e920b7e0f97df99
SHA1bb76012ded5acd103adad49436612d073d159b29
SHA2565653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
SHA512f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
-
Filesize
2.7MB
MD56418dfc9980cc0416a327961dacd41df
SHA12e32ab8ea0059606dfe66e978c271e0852406215
SHA25604bd8ee92194f076686eab2a94a119629b6d61e554782a0d4520359f1ceb24a9
SHA512d3e98fe91bfa4f7b9363d8fbb6997f20f76a638bcb5345d9280f919a4bf13dfa02d190534d1965eccd95f2300f6b4d29b6eaec5d544e5428377d1e26daf501a1
-
Filesize
10.1MB
MD52c367970ac87a9275eeec5629bb6fc3d
SHA1399324d1aeee5e74747a6873501a1ee5aac005ee
SHA25617d57b17d12dc5cfbf06413d68a06f45ccf245f4abdf5429f30256977c4ed6de
SHA512f788a0d35f9e4bebe641ee67fff14968b62891f52d05bf638cd2c845df87f2e107c42a32bbe62f389f05e5673fe55cbdb85258571e698325400705cd7b16db01
-
Filesize
468KB
MD513318cb90b385fb918ba6e07f1fd8d83
SHA1899985a7608268893c7fc1c9810568bdd8294b81
SHA25653a2d4c5ae582f15aad481e75e516ddabce9b756e553bed33720a66d2c5f736d
SHA512b5418f6bd2ab883dc1ef4d9f2c0a976296d06fe1309c6db7331a3470f198505561cabd41ecd05e675b90076196b4f82e8a9ef0574cfe96869bfb24d07cc82450
-
Filesize
7.2MB
MD5ad3edee84b49923e4847119eb4d6c6b7
SHA18649be26571d3fa645c416f36c1bdc0b27f1d478
SHA25651c9f2e9aecf5745ad343185cd39a05f581c2062d644bedcb25a5ef4b9624591
SHA512e504996b8371f294fa8a5173da48256e9070156249bdd7431e3adeacbd99f7cf39dc3c0876c4aa11da8d1932147cfaff91764c517a70d69d8c8e4876abbeea56
-
Filesize
353KB
MD5464e5eeaba5eff8bc93995ba2cb2d73f
SHA13b216e0c5246c874ad0ad7d3e1636384dad2255d
SHA2560ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1
SHA512726d6c41a9dbf1f5f2eff5b503ab68d879b088b801832c13fba7eb853302b16118cacda4748a4144af0f396074449245a42b2fe240429b1afcb7197fa0cb6d41
-
Filesize
569KB
MD52c933f084d960f8094e24bee73fa826c
SHA191dfddc2cff764275872149d454a8397a1a20ab1
SHA256fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450
SHA5123c9ecfb0407de2aa6585f4865ad54eeb2ec6519c9d346e2d33ed0e30be6cc3ebfed676a08637d42c2ca8fa6cfefb4091feb0c922ff71f09a2b89cdd488789774
-
Filesize
624KB
MD56352905a290802a05dd3a64d22216f6e
SHA111adb10f0678079c8f73779bb039e12329bcaac7
SHA25600861d9fa5763cc5c3152edb4a5c956c6bc4f56311ce2ed9e6b496181624ab5e
SHA5120b0dbad8201ebd1a7dc2cfb11325c509efbcced3ac3d337915cf2972defe2304ea9f8af91d9362cb51333459900a80b714e7302a6483ad58fd64404f8410b6ea
-
Filesize
652KB
MD538bcabb6a0072b3a5f8b86b693eb545d
SHA1d36c8549fe0f69d05ffdaffa427d3ddf68dd6d89
SHA256898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1
SHA512002adbdc17b6013becc4909daf2febb74ce88733c78e968938b792a52c9c5a62834617f606e4cb3774ae2dad9758d2b8678d7764bb6dcfe468881f1107db13ef
-
Filesize
838KB
MD59340520696e7cb3c2495a78893e50add
SHA1eed5aeef46131e4c70cd578177c527b656d08586
SHA2561ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39
SHA51262507685d5542cfcd394080917b3a92ca197112feea9c2ddc1dfc77382a174c7ddf758d85af66cd322692215cb0402865b2a2b212694a36da6b592028caafcdf
-
Filesize
400KB
MD583f9f785483cd92a73843ed98e674f86
SHA170e223dba0ecc5cf3f5fcf32278d97ff864c8024
SHA256f7f54b55a917a0f68e4b7ed7a3e6feabb224c52d09786b939712607ebe8ab0ea
SHA512df231f6774a9568cc4b85ad18d13c31cfb4de78830c72900ebd613d580e914e85eff85330ac9aa85246a0e4949891fdfb224ac615a03fcb0ce05b989391963e8
-
Filesize
409KB
MD5f36f1b2ff12fb87a578c36f73f5aac83
SHA173f61f7b6f191468ff4d9566a0bb6eccf1069cac
SHA256877a0a3dcb5d393365b2f775faff0d3593dd84b380a27dc72025597061a50ba7
SHA512c61a38f937dcc90c7dd5b87d9514147b6362d339d9af85bcb3677bb12ae5715d05426f6e67ffd3b441cc41530883a227096b4135b98f2d5c73f51612e0a0e4c9
-
Filesize
371KB
MD57ff057b530184205100dbea8635a29a7
SHA1f6e22b2e37e6d7bf0ca9bec220650f01d1a4a091
SHA25640b32636ffb813574d8a063ce7e74860ab06b93a9b16dd56b5b6aa602b5e6943
SHA51209b7b6c280d98f21beeddf1b9e5834462f29d299a64276c198ef3eab466b352695172d2ff118664c34e51a2b73e21949f203ba35b0bb6d3e031ac770e3e6b451
-
Filesize
397KB
MD51b928ff4831916bbe39e4b2e08f52267
SHA1dd8788bb4d386f7d0b8e685a09cc9ca361b7c31e
SHA2569c335a4e85b4ac58ed386d89d284be053ef288b2706a4cae433d91625ec1b31e
SHA51295dc4ecd45708277618a913bd07073a7cc61b642ae14fecc91ac0548898771a522a0672ee67399e5f5c8ca3006c37aa878b74af1f41717b9607c00f49e40124a
-
Filesize
712KB
MD5e66a75680f21ce281995f37099045714
SHA1d553e80658ee1eea5b0912db1ecc4e27b0ed4790
SHA25621d1d273124648a435674c7877a98110d997cf6992469c431fe502bbcc02641f
SHA512d3757529dd85ef7989d9d4cecf3f7d87c9eb4beda965d8e2c87ee23b8baaec3fdff41fd53ba839215a37404b17b8fe2586b123557f09d201b13c7736c736b096
-
Filesize
324KB
MD5e0c79cf2e5b790386e44b125d8e1a5fc
SHA11b75baf8035b81d6494f9f36930bbc8c512e1dbf
SHA2566b0e81b2198e025eae1e2f6d5d3a33ccce034d1f4bc59e4cade1b5f5adb99f1a
SHA512e4feb64ce7edf416422127280cf87967a5e6b20436a8ed33932b1bade73f0691ac819449d38fa0d8a81b888d6319f0b3167aa16e225999dfd6e7800d2365f2a6
-
Filesize
326KB
MD519d18f8181a4201d542c7195b1e9ff81
SHA17debd3cf27bbe200c6a90b34adacb7394cb5929c
SHA2561d20e626444759c2b72aa6e998f14a032408d2b32f957c12ec3abd52831338fb
SHA512af07e1b08bbf2dd032a5a51a88ee2923650955873753629a086cad3b1600ce66ca7f9ed31b8ca901c126c10216877b24e123144bb0048f2a1e7757719aae73f2
-
Filesize
395KB
MD5a510ff6703676bacde7e528823878018
SHA16551a7dac1c3fcd839b8d7c6ca92470f30a93d0d
SHA25677114f519743741a488a9b57cdc7190f0507c37dc3b29811704a048172ba6736
SHA512e9b75bc92eb077db57f906ef544b2339c4eb4f6eddf65d2570c36a00ab4b8a167a53e869d81150a7d097ecbf4ba19625ad4228f133392cc850352fe66fea47e0
-
Filesize
394KB
MD5e42486833449ea57261d5bbdabb8b4e2
SHA109734ed71302c7a3bf5f84dee1dfab7732bc0745
SHA256d539c88c4493cb1d9eae600611e3119fe129ec95149049f4b62fc3a97d78ca61
SHA5128ad283323c3f2e7a9d2e33eb86c371be6a9e29d9243e0d74d5936606692367212f81825d5c313a8859ff8de84eb6d23cbfc577ca47185392da803717f29e8b24
-
Filesize
356KB
MD58b3cb5e4b8ac769bde84e5c375c1774e
SHA153665908d6ec12095abd766911d8abcc84c6da58
SHA256c351b84558214420495bed6d882d37496483cc66b0e10400ca872e3fc4145b66
SHA512b0dff640d32e5c277f2d3441abf823e8859f28f215cfc63fde8a968cbc9b9531aa0394e10fa98284d186323e3357ea2265d762dc034be86bb50f5c55630ab4c5
-
Filesize
577KB
MD5e861a65f12b38a3def1fe9e933cae275
SHA18d083b5902a15a63ef11c7783f12e088d333fcf5
SHA256f9a8e3b9bbc809f11cc3dc32811940e033bd78a31ec154d28321473f8efa1e4d
SHA512d1fe91c693c794b4a4d60560800c919977654832e8f6e34fb1ec0ffbf5c411cf35b0a0e22e036dca48a246ab8d6bea0427c5ceb232d460e9c59cf4163d55314c
-
Filesize
365KB
MD57243727348009668ded33dd0109118c3
SHA1aa19e2e340c8328132d12ff79d8fd6b02c512a48
SHA2566581fca26336f66d8ba898ec1253b237db30e7cd1a25fc788290d7ace96fa6e1
SHA512e890346915c0891a9f49640f232f6633e25655b969911a6697adfea709cec59bb925678e0b97424936c59d523c3ee9e2dc23f115e20c45ca3ed51ae691d0d7f0
-
Filesize
410KB
MD5d7df2ea381f37d6c92e4f18290c6ffe0
SHA17cacf08455aa7d68259fcba647ee3d9ae4c7c5e4
SHA256db4a63fa0d5b2baba71d4ba0923caed540099db6b1d024a0d48c3be10c9eed5a
SHA51296fc028455f1cea067b3a3dd99d88a19a271144d73dff352a3e08b57338e513500925787f33495cd744fe4122dff2d2ee56e60932fc02e04feed2ec1e0c3533f
-
Filesize
426KB
MD53a5bb07820cf46c0f4a81a25724fe870
SHA1dbc296c1fc516c60d453253ee341ca4d31554230
SHA256b62c51b85545b3f5d70ac9c684a111689044636eafaeb196f5d52760e0f96f91
SHA5120222f7a8bf3a6f77fcb9ab7eb0d03509d15bb8634d556547ed55141d550af241a525cc99eb13957744fe2e6d4732b9dbe4d078cb3555b16af6c13e20b9f4e8a1
-
Filesize
812KB
MD59e189d21ad5843b69c352466c94cdc4c
SHA199af98cc510abe726b54f28488f647ea6f7d4c91
SHA2569c210e3143f99df59bebea6bdb6e30959f8520d59a20fffd437f7029840bb3a9
SHA512c3007f45ec20c3c3e763f20be1a5557f548a28757cb032617c20fe7d44b7524368b75b8182de243048aa56b939b2a790b5b85cf359b009c4c20c41089e8992e8
-
Filesize
507KB
MD5c6937badd93ff4ae6f6a2c9e31f678d5
SHA1b3175d7bebe340ab08e0d8e85d550a076b073c55
SHA2563cd4440501bc67d0b2e33e1346ba133fb9a09a8762f2334732f8cc349cd840b7
SHA512db232d7da04b4a854fd399fa04779469ec6fd0a752c4da7b2eed6d1aeaca4a096130fe326c91d777131d1a8ba32637d884e518f1522e9658d233a35e5eef9397
-
Filesize
848KB
MD5bc777a1010c846906d05d75d82f5dea9
SHA173bbeeda37164845ca3f4f2827165b4023f8a194
SHA256ccf7a557d0f8353ff3d656d4c2a4fca2d462ed2cc3d18c599d98f4d57b23c615
SHA512e6a01b80adfa31fa93d48fc4f1ba9222d21b8ed7734e664e4f274843b46d826ec8863483c0e8647e39ad85988dfe0a2848d32a26ce1fdd8a0eb85e4fe64be292
-
Filesize
397KB
MD5cbca0ad35cfa5c4b852cc8f556706b0b
SHA1608d2e11a40e5e15a2840e248a249d1562ba9846
SHA2566ea4b1a28cf567cca73ccdb7eec631fffba3b49acc41e3c88b448514578d80da
SHA5125b6f01c10d613f278d507d43fb0c708b32fd486d9b5a5f31a9837d0b1025da6ff85772b8f39e192cd8625d363be570565fd4eaf0f8d11c17ad6cbd956893022b
-
Filesize
427KB
MD52aa0a175df21583a68176742400c6508
SHA13c25ba31c2b698e0c88e7d01b2cc241f0916e79a
SHA256b59f932df822ab1a87e8aab4bbb7c549db15899f259f4c50ae28f8d8c7ce1e72
SHA51203a16feb0601407e96bcb43af9bdb21e5218c2700c9f3cfd5f9690d0b4528f9dc17e4cc690d8c9132d4e0b26d7faafd90aa3f5e57237e06fb81aab7ab77f6c03
-
Filesize
350KB
MD5366d1b2c3759d6ff9c588f53ec9a7c5b
SHA1e9d5c6e8311c6f7b7c4ad997db0cec5c11cfd754
SHA2560853a5543923b7a8db5989ebb8ebe8f9fb6271bfa59b94f5843f97de4401e2d8
SHA512879e72625fd112cec85a6489c590d7e89c65753d2beee259f7393e7377729d40bbb8cd0a2a9fcfde93d14c2cc9a97879312e60ab26035970a632e36d2f8d9e53
-
Filesize
388KB
MD58cde7372fc5095e581bf64fb77e04d61
SHA10d30e0ae2c401a06ffb4056bab44d2b5d3970492
SHA256d011fd39c3cbab740a7944a60a8dd48d6f76c563ea473cfd1f569c5e6fc9fa4e
SHA51283778880ad95b39b5746d512aa116b05928f580f0c5e75b45cddcb80addb24cf079f73f65771e1d75ca18925ea6fdb86283aa060af2cd1308dee53ee728f76e8
-
Filesize
472KB
MD5e9133185d2339d0a2f68c4c739eb3615
SHA1cfa6db85ec99bb38b734254b7d4a83d12ee5cd00
SHA256ba2acb635671a48ed0bf8cdc6e0a0318cfb33eb74b4171c6b483b95f2a167bc5
SHA512e89c886a601943d2089bad27ce9458f95929fd39fd2f88da0545f71e9d18a678eafc303630d0f94ab3af7c77ad19fabdb2616a2d004151232bc6ce1ae8e4c46e
-
Filesize
938KB
MD5fccd5d8ad5e1c774771b19dda55d9b9a
SHA1fabbaf469e4aec44342a7e6f74b837cde2203b71
SHA25647c77fdf73267865a025a54027865a8d67e26943264a43c6e794ccbd6eec549b
SHA512c9dc6cf0ff5a4094cc07ce4881319778a076b44651b16a220940d7a587ffaa92b6b80f7264605a3c8e6dd780e9c3d8e4d403d01cd8f94e0122ac19cd4d636aac
-
Filesize
398KB
MD554ace51d8b687e36a66a2bfde258a550
SHA11b2fe7c62e3f2c7deede2034e44980e02afa3b4d
SHA2568d131066e2fa004e11f9128162bfc354d3254381059d6c852bf88a55859ae3e8
SHA51250b825a88d646a32a4d620bcdf5ce490c8dfbea628c5256a6918dc647c42385f955396ec5d3b32cfdb50153897cf303cd517bc9f62663b14def2dae42229f640
-
Filesize
429KB
MD564b08ffc40a605fe74ecc24c3024ee3b
SHA1516296e8a3114ddbf77601a11faf4326a47975ab
SHA2568a5d6e29833374e0f74fd7070c1b20856cb6b42ed30d18a5f17e6c2e4a8d783e
SHA51205d207413186ac2b87a59681efe4fdf9dc600d0f3e8327e7b9802a42306d80d0ddd9ee07d103b17caf0518e42ab25b7ca9da4713941abc7bced65961671164ac
-
Filesize
427KB
MD54468d6a6114d5a7ea3c1173ae9a8250d
SHA1ef664a6a140fb7a244bce44ff8c73250856d8061
SHA2560ff66161377be2fb8b2b456a64dd910d8375a2b9f1f6f22333540a77111903d6
SHA512db4179b53cd44f297f5455a167ceccdd2a384c5296311346fa53f15ef5acab76cd166df13dbdf22b0c85a66455f22218e88c02fda2c5e2f863b9f4e7ea6e9a56
-
Filesize
974KB
MD5038b9eb34737bf472fde68b91a40f122
SHA164771e91d4fdac0b909c6f446cc2f310be7d1320
SHA25627b7947e36a521403de094cc563d5eced1e46f98e4d6b872fd424352f798e84d
SHA5123c96b42ab838f2ad5434e719f5906427a5fb327967d04c8498f3af4e913de833ac9cce6545fcfe0de2dc920cdf54c8b31c1d1527f609f90bcf9728d7bdbaac7d
-
Filesize
797KB
MD55657d67f6d21b507aab24ff62b0d4701
SHA1b685a327c525b7e42eece306984e6d88dd803a29
SHA256671c3cb2a805a63a275ad608d37d0577c6a2813dd67fb6c2b70f8232323aac04
SHA512637c60834edc6f31c80692274af05e3f78466cd5ddb2fd7c79315b0f54939f41f25c3b30c86fd10751d032def1f99cb853c3186128a76a3a82a6989eaf14a835
-
Filesize
365KB
MD5aee105366a1870b9d10f0f897e9295db
SHA1eee9d789a8eeafe593ce77a7c554f92a26a2296f
SHA256c6471aee5f34f31477d57f593b09cb1de87f5fd0f9b5e63d8bab4986cf10d939
SHA512240688a0054bfebe36ea2b056194ee07e87bbbeb7e385131c73a64aa7967984610fcb80638dd883837014f9bc920037069d0655e3e92a5922f76813aedb185fa
-
Filesize
358KB
MD555d5ad4eacb12824cfcd89470664c856
SHA1f893c00d8d4fdb2f3e7a74a8be823e5e8f0cd673
SHA2564f44789a2c38edc396a31aba5cc09d20fb84cd1e06f70c49f0664289c33cd261
SHA512555d87be8c97f466c6b3e7b23ec0210335846398c33dba71e926ff7e26901a3908dbb0f639c93db2d090c9d8bda48eddf196b1a09794d0e396b2c02b4720f37e
-
Filesize
370KB
MD5285f965bdfd40491c0669f41a1c9e2f5
SHA1b5c17191ab4d152c7793b6dec0a2e8f1fc298a89
SHA256b20178135b9f21feef0315fb2f2bc574c2876385e607a539ff0ce6ae7faf707b
SHA51203de0c35bc75fb96cc5871b5d06a49d99b92864541a3a03816c1245bef567401b260ed94b99818f81273395b1ec60a9f6cae22084ef34e01a95cc41da4fbd1b7
-
Filesize
412KB
MD5fbc79131a645b3853b4fa97c2b589a07
SHA191c6d4386384efa9074956b9e811a0aac385aa4e
SHA2560948238576efb502327af4040c1d9eb1346fbf1bdcee35cd46746b170a7ea6a7
SHA5120559d787bb7e4fa32a70c19cf0d1b2962d3869363904c13f345ef733f1193c73a13bad9600d7a5ffacf60b92cd97c27e27f7c4b7e143d0925fb358498c92f8cf
-
Filesize
389KB
MD53701247a5ac607053278aea185ee6616
SHA18cb40ddd4865347677f8d327792c6edb69012f76
SHA2567f41c3a58d08d98f21232e7c85839c9dec0053b447bb4dae867d2faadb278d45
SHA512637070ebc4411fb92bef5ff75eff46602db8ed59021f37f1a0d8201093f047419c558ec1af49c4dbbb4f58e7169e2f2cf04af7e1d11a57d39ab1cf036cb8497c
-
Filesize
391KB
MD5e032c0d39df2b7bfc71ece3bfe694039
SHA16664f303bae983a1bffcba22e9df712bb3cb59d6
SHA25660a5a7f03d4d54397ca04be0c89d1f67a496b72807c0bd660c076bc945b40339
SHA5123f12ed39848ad76411d4d84b2ccef59e2346d40c8e7ddbf6e333a2323df737d864126777fb54a15e90283ced2e7f04a7dda561fa2ebe13b30e082988b13e1406
-
Filesize
403KB
MD5d8b831a4896af7c78c534f1e8676ae37
SHA1175da19445b975b24a1e7bc8ffafa93d456ed10c
SHA2563a58f2275ea6a2baa68924b1dab6b0f06abf8b6657a878dea94b0060a95e38f0
SHA512e7e75dc7f92eb28759b567ec395f2a951c0e71284c75b9e2c4efd92209dda5767d51d51cdf591d04baddcfe88fbc2c8e6851a904d631b69bd801b9568767d948
-
Filesize
656KB
MD5e582616cb61afb76688aa7669936bbff
SHA1cd2e894a59238ce90be527156243546b4a3fc53e
SHA256e4edec80c9e29357bcf31eda5d8b046c6c9fbc6434a0b5594b6a906d5f1407d1
SHA512a5346390b6ec966d75839fb84e8d7284db55065b1a032ecd869a06555cdf116caaad73f9b059c92c17d5a5fb310a41c5f3b2461eee531b231adacb1b3d3d6cec
-
Filesize
416KB
MD507498676ad49df5cb1a14d91e2fc2353
SHA1da344ebcc2ed566b45668c8ff5b950cb921af71f
SHA256b7ba1d08ac8498ea6a37186a51b30d6d0db17136ac734982af4dab97f4a6cd9a
SHA512548dd27e98700681941ac13e6cf90a70c66520f70df51c75ecfbb32391805ee536a34f3e90400c1cfb34b750c9415378e1a75233db614c94a057da64d3369d91
-
Filesize
401KB
MD583ef046784c1b113e827cb744bcb8656
SHA1f6f3e0e975e7d3ca8e06f1988cb8a1c182eea734
SHA256ab2079923e2baa27c220df2f1559af8edc785f8e9fe2e12c8ecb0e0e7e7d0a09
SHA512f62f7e1eee91f5d42d591abbc7cb0fdf639834090824e7ab7f4dffb1e6c108c540074fdbadd5e153caecdb37b722ed9f737f13cbab387685013781949b9ee321
-
Filesize
616KB
MD5c68c235d8e696c098cf66191e648196b
SHA15c967fbbd90403a755d6c4b2411e359884dc8317
SHA256ab96a18177af90495e2e3c96292638a775aa75c1d210ca6a6c18fbc284cd815b
SHA51234d14d8cb851df1ea8cd3cc7e9690eaf965d8941cfcac1c946606115ad889630156c5ff47011b27c1288f8df70e8a7dc41909a9fa98d75b691742ec1d1a5e653
-
Filesize
361KB
MD5251682c6f4238bef8ab5471870a5454b
SHA12bf36466446abe39d487c61898d335901bbb09b0
SHA256e1cbce672de3ba3a01272b9b763dcfd8229fba0883df2b4117ac6b0f9916c073
SHA512de1e507b24e71f60c298253aacff49724b6a8c6336455d8dfcc6e939e53ed5e7a95dc5574e66a7fae38b6666446ac9cd83e5ad1b794b4ffa38d06052663c1f45
-
Filesize
379KB
MD567a443a5c2eaad32625edb5f8deb7852
SHA1a6137841e8e7736c5ede1d0dc0ce3a44dc41013f
SHA25641dfb772ae4c6f9e879bf7b4fa776b2877a2f8740fa747031b3d6f57f34d81dd
SHA512e0fdff1c3c834d8af8634f43c2f16ba5b883a8d88dfd322593a13830047568faf9f41d0bf73cd59e2e33c38fa58998d4702d2b0c21666717a86945d18b3f29e5
-
Filesize
964KB
MD5292f763cb8eb588659eb7cc25cf57d2e
SHA1dc42622f272843cb3afce9968146b85a98485237
SHA256d5bfe0699342b8bba6c4c73c115b1c7f3f903c4ed95d77461c34369f2f60d5ee
SHA512100ec32914f0d140baa414180cb2ba34e95f75ab73a0c036d6d5ebb64cc69b2b7c62b9e3f9de192bab8ddac3b387b953bed2ca1fd3bf0aab0198b9c1f2911151
-
Filesize
894KB
MD541e49a1ef6850d90e0cbdc720c45ea5a
SHA1a2fbe1585a1b653ac6acccaf6184ae2de3e007af
SHA256aa2b9d1ad8591e91872c3fee62b111b74d6e7e890a47d0bcc388947ae5245290
SHA512687ff66471248104f8780f142e1810ccc7275857e4bd188447d01cecbe74ebac4070ab135d4a7111bc5f4ae17247dd865f21a2d3e73031534dac1f5117bc4570
-
Filesize
753KB
MD5f9ff2275865f2cdebb9b0d19d4fb57a1
SHA1e83c6c8e0005bf34771af3f1c0c9d8ebaa822f95
SHA2563d4556bc0f26b89d090a8a779a8fda8f6fbe157a23181cbfb1d6c67a6212b864
SHA51296f596bb564e62bbafe62774fba1cefa644feff47a331e54cd7dc9b85b29f2a2e8e785e85d90cccc27f9a1c735b0a8c6dbe01fa244601f1359194f64a49ee6d0
-
Filesize
385KB
MD51525dd38ca529c56f9d3e08293385690
SHA1e0dfb9d60a3469d701dcb9ead8f8cd2cfe6fd604
SHA2565a7e1c8b572f67ed40e9d5107ddd6f8791b03138bb9933cfb26f1678b2c4a9cd
SHA512195ffc165e45a51c12b03252759c5e1ff684e57b5994aeca608d40ef6799f29812add6fb2479e8e8c1655799f4dbf29e47272324b857b9161ad43a1b271eddfd
-
Filesize
657KB
MD588d51b6df9f3cec54eda732dcf2c63fa
SHA1a826200f112d5c69f1aa5837bc40d4c423515029
SHA256e914b8956745a14d9d64f12698805e0910f9d3581dd380468949b54576fad2a6
SHA5123ed8f2090497597d4e2583901993331de19f9dc787ea886dabdaf22a79aefa2956e63501c9a50be34fabf7287b6751f50d9a5105e4f16a579961ebc0d6eff14e
-
Filesize
571KB
MD51ca4fa13bd0089d65da7cd2376feb4c6
SHA1b1ba777e635d78d1e98e43e82d0f7a3dd7e97f9c
SHA2563941364d0278e2c4d686faa4a135d16a457b4bc98c5a08e62aa12f3adc09aa7f
SHA512d0d9eb1aa029bd4c34953ee5f4b60c09cf1d4f0b21c061db4ede1b5ec65d7a07fc2f780ade5ce51f2f781d272ac32257b95eedf471f7295ba70b5ba51db6c51d
-
Filesize
455KB
MD5ebb5db1dbb64895b1a25120d5ac9b5e4
SHA1810fa53a97fe42994f8a68698d582651d69cfd51
SHA256ef3ddadb90dc73b73e25e9608626ce68d6778445812b8bd2f6c81e1f1e4bff16
SHA512fba594183c7b672204330ca698f1e195026fc51d4e05db2c49e58a896c3b5e11e23286be0d6ffae3ec321e6c08322544df3c876dbce3c2e69a951985a84a2c91
-
Filesize
332KB
MD50d5b72258b56c584113a022e16777387
SHA177f91e8c36befb818229ef8fef068e97f60ecf0f
SHA256539f0bfdb461bf777aab14a4baaf47c8c32ae1856cc4ac93b23ce73dc50ba02a
SHA512632c4ca60529c717fb2ba700d8f12017d097e67045639e2c30144a0372cecf595a2727d3505f019b91e8a15fe3259f2727bfb24e970dea8080a11e1a3dfa2068
-
Filesize
330KB
MD5c651e23053764c38a4e8a7f34317f19b
SHA193cd303c91024748d283c3779f11402cfb4f5c0b
SHA2569689ba3f2dc7248a3ab5db3b97d473e29464afbc7f2d1c7035f7e8e9a1c05aa4
SHA5121b7951fc4dcc2c08811dd3449fe2ce1302286b3eca21675adefa25a806ae7dcf91c565a111032fc5fda4dd9f5231875f0c77cdfd22ecc7d435450080d853a503
-
Filesize
5.2MB
MD59d000106fc3192e4c3d47031cf450131
SHA1814c455baba7dd4d9354ed061522fc4caad3e7b4
SHA256d0e884b68e2b79162e88b5d4a593c3bb4a7c60c5c62f4e3cc69a346727e6f7eb
SHA512b19e926fc5223375685854a0b26a04efdcd8128e44b3b56f3ed2cccb860b9069ff6e49dbae053a4287f12de6796643021a316baaf3f8505f5574171d8c6cf885
-
Filesize
105KB
MD5792b92c8ad13c46f27c7ced0810694df
SHA1d8d449b92de20a57df722df46435ba4553ecc802
SHA2569b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA5126c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
-
Filesize
158KB
MD5ac47bd259a01da6c51f750ea210b52bf
SHA1d6682fc4a07ff2313bc8428137f533e8947692a3
SHA256e87fb952df8e36a5461f328c37afd701f20c427810824e9541709cccb87c22b3
SHA5129bbd6e39597181da2cdaa0e3b4569e0a7a67b44f37be20b0bbe7cb6323501835427ce84044203c66c98b98fcf4e8e356e983be0e085f3020df93022d9c7e0135
-
Filesize
466KB
MD54d89b46abac43cfaec5c80ab2f735e15
SHA18985d96af0017b78c9b3791ea2ead72f3e32c844
SHA2564f69d3512c141d88a6137b08a1da04ab80d8e685bd5e9378865d6de828f0cb5a
SHA512477a676586b066813f1d469be6891b2cbd9575528d4279fd7da34f359057ee6025f82ce31c57a9e90658d52fd2e94779bd5a8a9c3d8f2283874450f4285da3bb
-
Filesize
5.0MB
MD530d193f1976035cebec2c2d8f071c556
SHA197b1d811743f03e888c22d975c9eb77ba92142b9
SHA256600e158b7d7fb95eb63552da1ae8159a6eb9bb04ff6341d11db2d10bd6c30c8e
SHA5124eb6ec91fb060f67ea126c9c7dd7f672161d86302db41c7d999f33239a7c18062cc020c06ab9571f8023c846d22bd0fa5c020fb4c710bf6a21472002dccb6226
-
Filesize
106B
MD58642dd3a87e2de6e991fae08458e302b
SHA19c06735c31cec00600fd763a92f8112d085bd12a
SHA25632d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
-
Filesize
899KB
MD57fdd1bec727e2b389c8ca84c407446c6
SHA1a91343d9f52883325f52f28c5dd142f4ae07b3ef
SHA256d04035c59f49444bd3cafd71296afd70bad5daa6e28bf5d7de3ffd0e36a85938
SHA5122fdd95185507be9bcbf6cfe1f05ba47e71203b1dc3ce4cc1553e5fcfb576ab89bf018a8927fc5e6e451b00f56f7abb5f2efd504e1a674b42dbe80deeb13d669a
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
Filesize5KB
MD5cdd149ae8d0e3cbdb68ea75b980a2cbb
SHA1fba7d38ca2d6fc19a8fb55efbd04565ab4401756
SHA256d527ece32321d23aec0075027670d90bce16d1788cd08e7cf5fad199cf797b34
SHA512ebeee63c78ba5db7f6466eb2b52f68266e3be7f43b9cf9980f8134a9e11c8403346e6f2b9cefc31d2fe1365c4e53d1c68a5988b8576326f90486ca943eebe8ef
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize15KB
MD5670f84f18a6e378438dbab67dae50aca
SHA16a42ca5c61b45f055da2525555225f2782d6e5c0
SHA256a8dccb90341fdf0cd454fbc33125788bab3b86628700d2c2ad02b49adad45c7b
SHA51214e5e34ae1afc96ce09446cd1e3a5628f41f6ebc4aea7bb00649ee69d9060bdf635287d1885e4b018e80cee2dd95223f0fbc8abeb2c6b4fb05fe0703c566b748
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize19KB
MD5efbf63c91b1d89fdd309604771492582
SHA1a40978626bc21dccfee9b5b1de14e531cef328cc
SHA256a95fe938c8ef8fcf9091f153daf665c178d241e10ab1b32607fb83cb0ade8359
SHA512cee1845fcb0ea6e66aa135acef9e3a9d74e346ec8fe3bc72d674461f54c227fc3cb934770fe487de00e6e4eac0ed4ba4f174ab2ca33af0b5699248e18023614b
-
Filesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\crashes\store.json.mozlz4.tmp
Filesize66B
MD5a6338865eb252d0ef8fcf11fa9af3f0d
SHA1cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA256078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
SHA512d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\datareporting\glean\db\data.safe.bin
Filesize182B
MD5b1c8aa9861b461806c9e738511edd6ae
SHA1fe13c1bbc7e323845cbe6a1bb89259cbd05595f8
SHA2567cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70
SHA512841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\datareporting\glean\db\data.safe.bin
Filesize182B
MD51c3c58f7838dde7f753614d170f110fc
SHA1c17e5a486cecaddd6ced7217d298306850a87f48
SHA25681c14432135b2a50dc505904e87781864ca561efef9e94baeca3704d04e6db3d
SHA5129f6e9bcb0bba9e2ce3d7dabe03b061e3fda3f6d7b0249ecf4dbc145dc78844386d047ee2ac95656a025ef808cd0fc451204dc98a1981cf2729091761661a3b49
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
5.0MB
MD58d634175c06cdf6ebd5a879ac45796c7
SHA1874dda7a871b35039a7b4031d1cfff215440ed3e
SHA25680fb77dd642b0e54c05d1d63258608ad1807f24542471df84f45c156420eacf3
SHA512cef399deaf724b0775b561bdaa67646701ba8d8c348ea7c6881bd311761878c6c46fc34b89e9902867decc0ddeece394da4d9c836057674f3436895fa9645b38
-
Filesize
7KB
MD5aa777272b87ab3d584364443ed4d62d5
SHA1b91bbb839f8f837748566f5d25b693ef45a4716e
SHA2569d577df426ccaec32f10d96302f77fa6a098142c59711cfd3a13e598aa8ded64
SHA512c70f5d6a7a4419d9ae0eab5809937c4b01863255784f74b4b5b16dd498ddbb1bb633325c0afe27aa76312c22296a854652886e18975454ed42e7ba16829059d0
-
Filesize
10KB
MD5a8c1ab0b6c91ddbc7cae408805a991ba
SHA10e59ba0f4192cd2dfa2bc87959c9dce53091287b
SHA2566741436a99aef0c61b60a720c13f7068fa54e2936d08c6f6b4bc44f41ab115bf
SHA512fd7794bb2387cd74f6ddca152a3a128ff91af26554d2f60a8b75138540fd9d0d045a4dc2c4b446df9557cddeab15a98ff2e6b3c2585187237236267763585103
-
Filesize
10KB
MD5efb30455f26cf397a4b1daf6ea6c855c
SHA1ebad0b0475d9069c16bf3515ae8b3651469f8fd2
SHA2566614ea56faad6dc2247606067eefc60be35b6106e27d0bb039c7b33f89d8e731
SHA5128ffc07e8184b78b257564e793c5505bc32c14bdb1c8609ad119f218bf96eb91b88bd5fa4864c338e3b9ff1ed5c990c0f7fcb61160a80532f00c4ceb57e1b0a8c
-
Filesize
9KB
MD531c9ae9101dc6243276b5c305aa823fc
SHA17e94f09899026035328012b22c601aa0ca166a8e
SHA2562b5704d2a9b9f15b284b9590bd13e25d86a3bc4bbf1efbf73509da6e7ba3d482
SHA5121d74df21cb12dca53e9600cebe40845b364e93ef530bb9fc0a724ea46f58b2b5730e1c29c4175c576950c679a89db7814ae26b33c0c519986388879a9e0e6731
-
Filesize
7KB
MD5c8814d3c84fc81836b28c39a518bc9ce
SHA1b6dd085e5676f0e63d4e2becbc31c02f8356c4f8
SHA256c3a778f8970bdd8663ba3bbbfcfba0028c80e14224879b9a1e8f6c55988102a0
SHA5120b507f027627938f72383342fcd9486055d181f0aa52cfc5b8479bf8a18d0462a7f8c6269d81beb770605e35fc4a1a229a067b1a7cb1cf2fc72ddcb92f67d698
-
Filesize
6KB
MD5d809fc31eb0e2eb6fc05d20a15e0ed93
SHA127785491c57d6470d55c602f907b0115153b960b
SHA256a93764cd0524a6b22d33676b6ff369123caaf6fc312718557c88d0454bda0c04
SHA5128c602f3221ccc1e9aaf32c9578b202f7b97fe11033805b2d5100e73b9a6a5c2527536034898ebd202b91ce0ab874148d1a068de500337c142a4f484862ea647c
-
Filesize
7KB
MD56f10e95bcac76560c054d5e3cfb15992
SHA1b8134cde4623291e13137d9e405577d18d44d4ab
SHA256a4bad20062a2569c5a30e21a8904b09313b988d0c7fd6994bdb1a4aed1fa5eea
SHA51263583b00341af6f0d453e0ed651e7c971076139c489bcb450667d891f5c15f2314eb9d79b59f67c3dad923c68d13554c2ba5b4303ac9293461c7ed96cd89d7fb
-
Filesize
7KB
MD5cfd650ed49de121d671f5cab5e7dfa03
SHA1ac93bcd4699cbc82b42403ce032cf783ea20c23d
SHA2563b9212afa5f77ea81d20fac6b9bb7dfd213d81baf4b8be15ab3c6f96d57d5a3b
SHA512855b1c3c55b10c2c855fab1b66cd222d97101266782873c828df09d7691a1cf88ac5b56f3831b8fcfc1f3387596f38d8b9d6c56fb7b271cc33ab5a76fd0beb8a
-
Filesize
7KB
MD57ede769da4defd80bf9c99d0e1bf076a
SHA1d7a768f888d85114c0baf3ef6733ff43d7c612c4
SHA2563d8c02470af1424b751a77955c9ecea00ddf164c7da7adc71e2921c36b32207a
SHA512d94e46c75ccb237cd2e85101f735558ea1494f7786b24d89a4c45dd1ac7136dceb2a8a939b7347096ad5696c13b57d895c391579376d4529044e566ef85ab44f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionCheckpoints.json.tmp
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD500af3b9fb849223eced378c514d55914
SHA167f5fd41c1ae8e0a3a6a4162a050eea5049832c5
SHA256133ce83c99a8cb0eed478caf358da7613fa6f00d3e2f61730e2a5814db62f72e
SHA512d3e2350ec9123f4628e7afb5274e86e76c6f7672b4e44873cac6b56a5ed5d5e4d5a0f7ac55233fb0b3f0b26643fb65a76774899ef3c6971c4ae3ab0ad750a771
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5b8eb36923d812d8476b992d601db603f
SHA1cbaee9b023f170137bc201252aade0bff6af2c7f
SHA2560a6e8354170d584b0ada186e2bc62e080627953639e8024f17c76eb2ae4b65bd
SHA51248025280fe744476e261e855f963c8ccd63fa59b3aa2052d4f23402ec458463d7ff120880800c33be4e5799a9b360ef9fc87ec15c0061020423b114521c52fb7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD58c6d712c1418938cebfd3f00429c34b2
SHA15e759a4cfd97a20ae4fced00048d08e96c5e3c01
SHA2566e2b454903ac98dcfbaa9209fbc9d747fd4b7cec38436df9c1ccd72e8aca5f07
SHA51229aa3f4013d1d0e279eea77ca30c17c10e628ec7f5bd97a30aefc52d5e9447e8c20602aa2e8ae15ca9087e32e9c942237e1aba637fa265b14223c20137224ce3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD50365dd9fc6f603c47e3c198091b739eb
SHA18dc145787567106a79ffde9e59ee3443867ab3e3
SHA25687bd3a6aa7325e04c8f3e30d3d9ff8de38173699333330a4acbc47fa6b752443
SHA512a31449c1da7a8be40f2e1042aba90e93be8afcefc1f4809cf03ab83bd589facdfea657d5e066d103957360ba6053666ac8dfe97cf324ec96a9752908afbfa216
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5e151ce639004fb298f3ba52404a3a010
SHA14d21cd9f55b9cec68899f7b7c9ece99a7b72d123
SHA2561812181db098cdc9a57455eaab72ca8d18c735d5d8af0b7f00f4b036d9c7e3a4
SHA51261967ecc92d65bbc9f2e278b12fc32781afd9673cb039d626acf872150a53f8d7eb71834d461567bf85e3d123e49ff87dc7ed55ada662f4964871318abf15cb1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD517b6218e0b7c2bb1e346457e75718f9e
SHA1b60f326c856c71586fdfa59e6557e08a2386fb9c
SHA256582d1b04baf3c5460ac8e4eeea5e6efdf64f84175d46bbb8ba0447397b863f32
SHA5128b6d1093eecf5161591fb53af57635addfa25c07d87d42a08629f7751459fd3698bd6dae6f28d089f1ce688796de52968b8e5878e6fe9a96e91d40505fc1ebe4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize2KB
MD5509d8c2348efeecba67331073c304192
SHA16d42e3d5fd6a5861682349a709a9395274be5779
SHA256fef0c4cab8bffda7f62318aa7878588a2720783c1088385151a670f61021ae7b
SHA5129446040009c5125ea38f42eb2e982fd279ebb6b17fb90eecf67f9c6aa0c3f55fc3a5abb46934d389ffbda6197aa666fd04c72ea6144aa6533a9e63f7babad253
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD559d53c83087b0dda88d9058c282dd21e
SHA1ad844f4a4534b215db1086c3cc97ae3c9cdb3711
SHA2561e06a16bba647e9c2014b872d52b9ec43cf3c4ad3a4c2838528e246964116f98
SHA512c93f155c25cf459463177657c4074c8aa0c8d89e906d6df70ae5c7dedde5d537e22cf99cbce3b512ade4d3661aad9b3e7fff855d302d940608a6ba0e8657908a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5566e995bd811475432b2d06039c0a6eb
SHA174ad6260a4676523e7e2925b753b66eec55a83f5
SHA2561bc9d0647917f4a94db1ae8e7bf2bb0d70d984ae2bb7e515b52450bfea5acad4
SHA512a1e856a56efe9220fe8cc9aaef0d87bdd52edf1d184a48acd7a0a57737d0f0fa240548f0760cc53074a520362d28e26e1652e74c96794764f74c178001eba73d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5c7da6a4375e979fcf3cc9d6a647234b5
SHA1de5a0115b805a974631d2b51ac0acc0b4f7d40dc
SHA256076d399d7db2461d2064fdd969b2be2d5400330509bc9af9b97e1f3386bfd34a
SHA512593c23518d053fde42bcac5d90bdb1f08aa30eb319f7945e97b9d012e54c1917c11ea9e261665c732948d28e5f769d4570bfbec664c40db82a71ad794013af23
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD52dd15c2ed63360cf65d8b9b7c5d0739d
SHA13b81d18fb59f826209a5b7c74d53eb4dca3ef893
SHA256dbcd7c7f1f00da74e7abaf6b0683e4ce5c587d4c2e120183d9da2ece21369fcf
SHA51265af11a9b3529d538e75df1f321997cf11a6a285a8b3e710668d67085f2f7c112c949617da378a4bf8af50a760b2e35001c5cd7193a913efef74c81485403299
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5744c0949f97cf2b8f41e6608d4e5fab5
SHA12477671112e9d75c97d0c44fd4aadf4fb61c9e24
SHA25670514fb4a0cc8c0780eb9dc60fb7c1481c95a1368b611eedb6baa246a6b1c1f4
SHA5125c079f3c557651e344dc476af1220789a36b246fe589508658f1d0cd5fc8035236f8f5b727caf6c7fc96c93492309251bf7b86459f66b9ad08b73eb4582185f1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5df03fa17d39ff670fcc9d2c0229313cd
SHA19fb123d94afc29a84b39227445b976413863b684
SHA2560aeb9971755ddec6657fb02a189a5bea7caec4c6bc48c1d6987cbb56bdf5b288
SHA512ea9bb03d86b01c1ae7c18be2bedfa89441da53c10061986fb8406344f6053e5b942bb07c1753801a406177bdcf88ef780ad27235ab4d7a96346b9d5bca016af1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\rfj66zji.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD5f684502844c9b37b0ece01fa9f936351
SHA1ad53e26306805ef92460bd95a3035cffaef137ea
SHA256c2e3e1c2574a671d2d0f2bcd6bc0a7cc62353ee4e51b801e107139d60668bd45
SHA5122e982296b86fdc9455c168adb728796d3ec41325e3b09ef31b5428be7e9b97544b2cdf83179bd5e7c3555327a9391195baf5012e769fb4c8471a288d8bbc898e
-
Filesize
169B
MD5c859223b69b3161401ec15d3ea7919e8
SHA122237153c01db50355ca7b4dd2d5a9776919ef2a
SHA25653265d8deed9f1d999590412259413551f66a340d67880f4cd3f44b444471655
SHA5128b462a510ed00ed7a6265d87829ad362468465241a8be9765e032ca5ad86d4a492d48f8903376d93fcd45aea2b69637df765a04fe39f9ffc474fccdde7a3b7b5
-
Filesize
11.8MB
MD5092fe02c895aa5f6dd337e4e5c095c67
SHA1992c9011a4658fefb7989844b18d1d6bf299953c
SHA256e1148f50535be8daf6feff1c166a6175526096d9bb17fca1ba51df0daa7ce6ee
SHA5128759a99ff30de8f8bdbccef3bdb04c1249c4be00bdf4b079bea273f1360c5afab77ed367aed02c77261b925dd1328d8bbd535d8783596341b92cd3afe2e61113
-
Filesize
15KB
MD55849a402c052996061b2e80e500a8c46
SHA1c0e96c3a2ef2b476d99d6525353ca3fcc9ed9e4c
SHA2568e8f71ca4a415ca4bf9e5dc5e7f1570e85ec7050d8e51d02dd638012359567c9
SHA5124cfacfa5e8c208f6879a770e11d40d25da36e4764ee49e9808ce0a6c342e52d283361c339cc4083a7b08ca2bc81c6448e8e75868a8fa0e11b6dfdb5ca932d146
-
Filesize
12KB
MD5ee42fde64bdd92400e7e8e2253e0f703
SHA1debea69fd66d811dd05584098920566d372d1cdc
SHA2569539590c8f82f0182352d926df8b4c48ba1cf78d2df0563e995eb73ee3b32583
SHA512dec62d8605d0fdfc081eb895fa8ebac0da2286b133de6e8f459c0e0ad9264d6dddfdb5991c7f77ccd1efff4689cecbc79498404f8f2762c30bcba29782919333