Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240729-en -
resource tags
arch:x64arch:x86image:win11-20240729-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/07/2024, 22:45
Static task
static1
Behavioral task
behavioral1
Sample
072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe
Resource
win11-20240729-en
General
-
Target
072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe
-
Size
2.5MB
-
MD5
053a0e31227fe60b257a3b2f93be5a4c
-
SHA1
4bcad3d3bde9de21ff7326a8137129f6773108ab
-
SHA256
072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d
-
SHA512
fdff9c25a0571b9f45b3dfebcf34d42a22868f1f741b6af0b5ba830ed962d24bd0289fe22e918e616943868d8091c0ecf953b5c3d4fbc1bdae1f2e1f1663dbf1
-
SSDEEP
49152:xhyhSy9ufhM88Sm9uxaZCoXZxDC3B1zlKmzD+aBP7fpbj0Spo:xrKmRK9apoXZBCbzXXnPt4S
Malware Config
Extracted
stealc
dana
http://85.28.47.31
-
url_path
/5499d72b3a3e55be.php
Extracted
amadey
4.41
0657d1
http://185.215.113.19
-
install_dir
0d8f5eb8a7
-
install_file
explorti.exe
-
strings_key
6c55a5f34bb433fbd933a168577b1838
-
url_paths
/Vi9leo/index.php
Extracted
amadey
4.41
fed3aa
http://185.215.113.16
-
install_dir
44111dbc49
-
install_file
axplong.exe
-
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
-
url_paths
/Jo89Ku7d/index.php
Extracted
redline
25072023
185.215.113.67:40960
Signatures
-
Detects Monster Stealer. 2 IoCs
resource yara_rule behavioral2/files/0x000700000002b1fc-3425.dat family_monster behavioral2/memory/6668-3579-0x00007FF7D51D0000-0x00007FF7D640E000-memory.dmp family_monster -
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/files/0x000800000002b1fc-3606.dat family_redline behavioral2/memory/6560-3617-0x0000000000920000-0x0000000000972000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ axplong.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ RoamingFHIDBKFCAA.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorti.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ dc086a0cab.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 7024 netsh.exe 2336 netsh.exe -
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RoamingFHIDBKFCAA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dc086a0cab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RoamingFHIDBKFCAA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorti.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion axplong.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dc086a0cab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorti.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 5376 powershell.exe 7104 cmd.exe -
Deletes itself 1 IoCs
pid Process 6668 stub.exe -
Executes dropped EXE 17 IoCs
pid Process 1676 RoamingFHIDBKFCAA.exe 924 explorti.exe 1916 157321c086.exe 5588 1ddc174e28.exe 6420 dc086a0cab.exe 6680 axplong.exe 6864 explorti.exe 7052 axplong.exe 580 explorti.exe 6468 axplong.exe 5500 build.exe 6668 stub.exe 6528 crypteda.exe 2716 khpRFabs0a.exe 1504 xnXc1Iotp5.exe 964 2.exe 6560 25072023.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine axplong.exe Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine RoamingFHIDBKFCAA.exe Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine explorti.exe Key opened \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Wine dc086a0cab.exe -
Loads dropped DLL 35 IoCs
pid Process 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe 6668 stub.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000\Software\Microsoft\Windows\CurrentVersion\Run\157321c086.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000020001\\157321c086.exe" explorti.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 43 raw.githubusercontent.com 115 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 40 ip-api.com -
pid Process 1720 ARP.EXE 5204 cmd.exe -
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 6512 tasklist.exe 1012 tasklist.exe 5392 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 5028 cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
pid Process 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 1676 RoamingFHIDBKFCAA.exe 924 explorti.exe 5588 1ddc174e28.exe 6420 dc086a0cab.exe 6680 axplong.exe 6864 explorti.exe 7052 axplong.exe 580 explorti.exe 6468 axplong.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 6528 set thread context of 2768 6528 crypteda.exe 199 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\explorti.job RoamingFHIDBKFCAA.exe File opened for modification C:\Windows\SystemTemp chrome.exe File created C:\Windows\Tasks\axplong.job dc086a0cab.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5868 sc.exe -
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule behavioral2/files/0x000100000002b220-3443.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
Program crash 3 IoCs
pid pid_target Process procid_target 720 4632 WerFault.exe 78 5624 5588 WerFault.exe 126 6676 964 WerFault.exe 212 -
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RoamingFHIDBKFCAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 157321c086.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddc174e28.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25072023.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc086a0cab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language axplong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crypteda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language khpRFabs0a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnXc1Iotp5.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 7052 cmd.exe 6560 netsh.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 5092 NETSTAT.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 1584 WMIC.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5028 ipconfig.exe 5092 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5628 systeminfo.exe -
Kills process with taskkill 1 IoCs
pid Process 4248 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1190969173-1381737754-2099412069-1000_Classes\Local Settings firefox.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 25072023.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 25072023.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 1676 RoamingFHIDBKFCAA.exe 1676 RoamingFHIDBKFCAA.exe 924 explorti.exe 924 explorti.exe 3260 msedge.exe 3260 msedge.exe 2200 msedge.exe 2200 msedge.exe 2512 chrome.exe 2512 chrome.exe 572 msedge.exe 572 msedge.exe 2652 identity_helper.exe 2652 identity_helper.exe 6420 dc086a0cab.exe 6420 dc086a0cab.exe 6680 axplong.exe 6680 axplong.exe 6864 explorti.exe 6864 explorti.exe 7052 axplong.exe 7052 axplong.exe 580 explorti.exe 580 explorti.exe 6468 axplong.exe 6468 axplong.exe 5376 powershell.exe 5376 powershell.exe 5376 powershell.exe 236 msedge.exe 236 msedge.exe 236 msedge.exe 236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2512 chrome.exe 2512 chrome.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeDebugPrivilege 2720 firefox.exe Token: SeDebugPrivilege 2720 firefox.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2720 firefox.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 2720 firefox.exe 5588 1ddc174e28.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4632 wrote to memory of 2976 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 81 PID 4632 wrote to memory of 2976 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 81 PID 4632 wrote to memory of 2976 4632 072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe 81 PID 2976 wrote to memory of 1676 2976 cmd.exe 83 PID 2976 wrote to memory of 1676 2976 cmd.exe 83 PID 2976 wrote to memory of 1676 2976 cmd.exe 83 PID 1676 wrote to memory of 924 1676 RoamingFHIDBKFCAA.exe 86 PID 1676 wrote to memory of 924 1676 RoamingFHIDBKFCAA.exe 86 PID 1676 wrote to memory of 924 1676 RoamingFHIDBKFCAA.exe 86 PID 924 wrote to memory of 1916 924 explorti.exe 88 PID 924 wrote to memory of 1916 924 explorti.exe 88 PID 924 wrote to memory of 1916 924 explorti.exe 88 PID 1916 wrote to memory of 3092 1916 157321c086.exe 89 PID 1916 wrote to memory of 3092 1916 157321c086.exe 89 PID 3092 wrote to memory of 2512 3092 cmd.exe 93 PID 3092 wrote to memory of 2512 3092 cmd.exe 93 PID 3092 wrote to memory of 2200 3092 cmd.exe 94 PID 3092 wrote to memory of 2200 3092 cmd.exe 94 PID 3092 wrote to memory of 2384 3092 cmd.exe 95 PID 3092 wrote to memory of 2384 3092 cmd.exe 95 PID 2512 wrote to memory of 1064 2512 chrome.exe 96 PID 2512 wrote to memory of 1064 2512 chrome.exe 96 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2384 wrote to memory of 2720 2384 firefox.exe 97 PID 2200 wrote to memory of 4756 2200 msedge.exe 98 PID 2200 wrote to memory of 4756 2200 msedge.exe 98 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 PID 2720 wrote to memory of 4044 2720 firefox.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 6120 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe"C:\Users\Admin\AppData\Local\Temp\072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\RoamingFHIDBKFCAA.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\RoamingFHIDBKFCAA.exe"C:\Users\Admin\AppData\RoamingFHIDBKFCAA.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1000020001\157321c086.exe"C:\Users\Admin\AppData\Local\Temp\1000020001\157321c086.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CB7E.tmp\CB7F.tmp\CB80.bat C:\Users\Admin\AppData\Local\Temp\1000020001\157321c086.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"7⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7fffe289cc40,0x7fffe289cc4c,0x7fffe289cc588⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1820,i,11733411346376710500,12748862161298263614,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=1816 /prefetch:28⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,11733411346376710500,12748862161298263614,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=2096 /prefetch:38⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,11733411346376710500,12748862161298263614,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=2168 /prefetch:88⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,11733411346376710500,12748862161298263614,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=3144 /prefetch:18⤵PID:6092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,11733411346376710500,12748862161298263614,262144 --variations-seed-version=20240729-050126.230000 --mojo-platform-channel-handle=3184 /prefetch:18⤵PID:6104
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"7⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fffddd33cb8,0x7fffddd33cc8,0x7fffddd33cd88⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:28⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:38⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:88⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:18⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:18⤵PID:572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:18⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:88⤵
- Suspicious behavior: EnumeratesProcesses
PID:572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:88⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:18⤵PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:18⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:18⤵PID:6184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:18⤵PID:6192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17668327189524281136,14278899577735127295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5524 /prefetch:28⤵
- Suspicious behavior: EnumeratesProcesses
PID:236
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"7⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account8⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1864 -prefMapHandle 1856 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {39295c84-ba75-4aed-b23b-8cb8652fad09} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" gpu9⤵PID:4044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ef28bef-d0da-4fd7-96fe-aceb3fc013de} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" socket9⤵PID:4832
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3372 -childID 1 -isForBrowser -prefsHandle 3364 -prefMapHandle 3360 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16ac1f74-bcf7-4e55-85fe-2124c82e8c9e} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" tab9⤵PID:648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3552 -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3564 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f008c8db-a416-4c33-a6a8-107f9bc402ad} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" tab9⤵PID:1620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4124 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4220 -prefMapHandle 4204 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5ad269b-969d-46a5-ac98-aad7be174563} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" utility9⤵
- Checks processor information in registry
PID:5716
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5348 -prefMapHandle 5344 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {591a91f3-3ddf-46ca-85fd-fd454199e8f9} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" tab9⤵PID:5948
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5520 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baf4be70-0296-4996-b308-4c88b18dd851} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" tab9⤵PID:5180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 5 -isForBrowser -prefsHandle 5412 -prefMapHandle 5504 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3dac0b3b-5f84-4002-97bf-de97c9ad13a2} 2720 "\\.\pipe\gecko-crash-server-pipe.2720" tab9⤵PID:5892
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"5⤵PID:5940
-
-
C:\Users\Admin\1000023002\1ddc174e28.exe"C:\Users\Admin\1000023002\1ddc174e28.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 11966⤵
- Program crash
PID:5624
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000027001\dc086a0cab.exe"C:\Users\Admin\AppData\Local\Temp\1000027001\dc086a0cab.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6420 -
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6680 -
C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"7⤵
- Executes dropped EXE
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\onefile_5500_133667669445101818\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000001001\build.exe"8⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
PID:6668 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵PID:5592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"9⤵PID:6548
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid10⤵PID:6640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"9⤵PID:4456
-
C:\Windows\system32\tasklist.exetasklist10⤵
- Enumerates processes with tasklist
PID:1012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe""9⤵
- Hide Artifacts: Hidden Files and Directories
PID:5028 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\MonsterUpdateService\Monster.exe"10⤵
- Views/modifies file attributes
PID:6120
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""9⤵PID:6796
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"9⤵PID:2848
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe10⤵
- Kills process with taskkill
PID:4248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"9⤵PID:6976
-
C:\Windows\system32\tasklist.exetasklist /FO LIST10⤵
- Enumerates processes with tasklist
PID:5392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"9⤵
- Clipboard Data
PID:7104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard10⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:5376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"9⤵PID:7032
-
C:\Windows\system32\chcp.comchcp10⤵PID:440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp"9⤵PID:5268
-
C:\Windows\system32\chcp.comchcp10⤵PID:6532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"9⤵
- Network Service Discovery
PID:5204 -
C:\Windows\system32\systeminfo.exesysteminfo10⤵
- Gathers system information
PID:5628
-
-
C:\Windows\system32\HOSTNAME.EXEhostname10⤵PID:6540
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername10⤵
- Collects information from the system
PID:1584
-
-
C:\Windows\system32\net.exenet user10⤵PID:3528
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user11⤵PID:3156
-
-
-
C:\Windows\system32\query.exequery user10⤵PID:3036
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"11⤵PID:236
-
-
-
C:\Windows\system32\net.exenet localgroup10⤵PID:436
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup11⤵PID:1460
-
-
-
C:\Windows\system32\net.exenet localgroup administrators10⤵PID:4192
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators11⤵PID:1096
-
-
-
C:\Windows\system32\net.exenet user guest10⤵PID:2384
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest11⤵PID:1256
-
-
-
C:\Windows\system32\net.exenet user administrator10⤵PID:4808
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator11⤵PID:1576
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command10⤵PID:4456
-
-
C:\Windows\system32\tasklist.exetasklist /svc10⤵
- Enumerates processes with tasklist
PID:6512
-
-
C:\Windows\system32\ipconfig.exeipconfig /all10⤵
- Gathers network information
PID:5028
-
-
C:\Windows\system32\ROUTE.EXEroute print10⤵PID:6744
-
-
C:\Windows\system32\ARP.EXEarp -a10⤵
- Network Service Discovery
PID:1720
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano10⤵
- System Network Connections Discovery
- Gathers network information
PID:5092
-
-
C:\Windows\system32\sc.exesc query type= service state= all10⤵
- Launches sc.exe
PID:5868
-
-
C:\Windows\system32\netsh.exenetsh firewall show state10⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:7024
-
-
C:\Windows\system32\netsh.exenetsh firewall show config10⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2336
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"9⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:7052 -
C:\Windows\system32\netsh.exenetsh wlan show profiles10⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:6560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"9⤵PID:5960
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid10⤵PID:4940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"9⤵PID:5884
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid10⤵PID:2032
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6528 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵PID:5592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Roaming\khpRFabs0a.exe"C:\Users\Admin\AppData\Roaming\khpRFabs0a.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2716
-
-
C:\Users\Admin\AppData\Roaming\xnXc1Iotp5.exe"C:\Users\Admin\AppData\Roaming\xnXc1Iotp5.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 3848⤵
- Program crash
PID:6676
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:6560
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 26642⤵
- Program crash
PID:720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4632 -ip 46321⤵PID:3928
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2216
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4788
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:5828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5588 -ip 55881⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6864
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:7052
-
C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exeC:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:580
-
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exeC:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 964 -ip 9641⤵PID:5764
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
8System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
2.5MB
MD5053a0e31227fe60b257a3b2f93be5a4c
SHA14bcad3d3bde9de21ff7326a8137129f6773108ab
SHA256072de0101830ac91ccc185b9a8ace588c0ab954efb4fa283b73f22b78622993d
SHA512fdff9c25a0571b9f45b3dfebcf34d42a22868f1f741b6af0b5ba830ed962d24bd0289fe22e918e616943868d8091c0ecf953b5c3d4fbc1bdae1f2e1f1663dbf1
-
Filesize
264B
MD53ecf4e66b31f213c7903875708ab2a3c
SHA1c3e576a7b1da1af3c9c17851d62d05adaee98f8f
SHA25648c76c720be25fe0ebb45f7b0127c7b41497163529707fd86d4d6a1d60ebf73f
SHA512dcb724e536a55b804b865fe3b7eaf18301fcc39e4c79077b5ddcc54ad70233b18024c1c99ecbef7771547b7eed00ec825a6e288352094c5536ebed1abc4f488a
-
Filesize
3KB
MD522b47a009e362275471b7ea635217256
SHA18ebea0c2f241b8afe3ffb4b1438f2c8539600edb
SHA2563507b88d9526f5387e02637d6dbb338ed2f2ddf359dab4bfa6199073af7b6780
SHA512c9947690b6fef29245837f035b593efeea2bce6a659c1533509fd6694348cbc2bb54ffc69e5472f78978e606feb6fe4bf9535f97523776ea289f306102e1f3ee
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
352B
MD550a835b044d82925916f1bd225385763
SHA112947ec9c3362511ba499039c105062b535cb87e
SHA256707a2da4a2ba92c6a1189afc73e4ba2b45c8b831c1b845d9b2f75df25e547fe1
SHA512a36956d2f6a686e61a3a78404c120fcaab015f35e014d88bc25fc13f24839fb10b72afa7dc4af776857f10f307b7e493bb6a2269994b0eac27e9ca8a6982d122
-
Filesize
8KB
MD5f358cdab45a31e6e76cb09285dfa317e
SHA1d20cc17a277f49a4f11a63c16b63982d475ce350
SHA25694afef86f1e88240094b2f61267b5b5d6796796712bf7e881f4f14a6d3adb8ef
SHA512885ce97edf017fe576b62fd9cd848d926fb0ce88fa14c86167ad39332dfe61b2133e2f03f4f25c5ee82178554a13dce976360d63f5cc9d5ae3de256fcef5b081
-
Filesize
8KB
MD5b24fdca961fe311ca345b204a6d0ff9e
SHA139ab88c62f590108a7ae5b937822a6d12b95054e
SHA256f009c203902b4e3f120aa48b70e09ae237113370a93d265bf623a22afccc8f99
SHA512237b5e08890914d243d367416e226d1a07c8c4ad82daa3bfb7598662f89f81b734460a91c98abd6bb2acd2301ba60838df97c5bbc7ece80b708e384394b0986c
-
Filesize
8KB
MD5ef8e1020ead84bf53f5037434504fdcc
SHA1312c31a7a80090d7b1d451c384ec51001384d919
SHA256779f3dad2799e3d8b6ae8014e419838e94eaf811a592073221ba7fe783dacf45
SHA5128ecb1c8ef1eb11b35a1800c20f3e411faa834c5a70dc402a7278d077e0010b9bfe72e682ca9dfca9e05472a1d5a2496cc6af70f5e4eb362765fc8c6382535aad
-
Filesize
8KB
MD5e6be3053bcfd5533f64da2b22a8326f7
SHA1a051fa3105b0ccfb5f098c48469a2a3f48c181aa
SHA25698738b322ef876261d6d3ec2feeb8376a2bf119804e937ed68e3ba05447fc076
SHA5124252616dcf08641f3e1b493e932f5f344744440e2dc72748e528940c9b5dd510e926da0f575b207b58aafc6b16dab7e9d11ad6da3ac30e0a31d752d353108c8b
-
Filesize
8KB
MD514981f6d1922a3d14c0ebf270d1a5353
SHA10758621bdef05caf0ceff23b453f1f3dd7c946d6
SHA256b127d323f0afdd15ae13ca225df66785ac10a29db10806f3666746766a750aba
SHA512f4b99ce47ec0d559883ae4baa3717aee2c09c3b9d3936b1eb5c74b4236c9e6543f13dd21ab58154e5a68a74b48f786d956140e8ea6a599927bcc1cf730a202e9
-
Filesize
8KB
MD5a7a1fc18ad8ee384b36887871e6aa70e
SHA157caa941f40e708fbd2a4fdb5a9aebf8d3231b03
SHA256efbef36610e04ce740e74d9c41abef0bbffc76ded0867ed6b6f43c7cbb7157f4
SHA51255b17dbe50dbfff73877bd7b0f4f0887a972dca730e7ae7b27bd5523bdb3bda74891409678fa8acaff82a68c8e61dfd59d81a85d7043e920487b027c59becfb0
-
Filesize
196KB
MD5e628b7af5b45dd88e93440da055139da
SHA1b2b5a6b4193192022c847edcb1696a4803f95e94
SHA2564534a507bbfa1392802d1b4d5640dc3bc4c0fd41077a2cbe010ab685b8fd90c3
SHA512b63127d297b9b514f8c07e12e4d85f67c9275d4896f0b965de4ca2f830c52ebc9bd3ad875499ed9da0393d5cf74d989a699bf8e90422a18c790b111432f01c9e
-
Filesize
196KB
MD51366165509e940cd8c2538bd2f7d7249
SHA1faf0c60979c0b5d8824685509f67a623011f3eb3
SHA2560e9d7652c46024c13280b50fcee3a540d51576e6d2f30a0fea536626cbfd0bae
SHA51224c41e22e16ad8fdeca3848ce947073e024dca38bcbfba15c427c31ec2042bd16a398976ca3cd2bc28a5f6337cc5211ce4d401d8495ac38e26b13da6b99275da
-
Filesize
152B
MD50b2946bd56a8142b51e97acf601cec62
SHA1352e245063c513cdfc8e0b32c88157b23d7c3042
SHA25609dbac8e0cb7d1cfd7b23332aff14ae4adc2602004fc3455ba40ee461fae43ae
SHA5124fd2b0e7f9e1281548093791b0540277472bd71394f9255df4e7fa5cb6a2609d501e604e9cc5a88fcd8749540292f5074a16fa2ef851b5d06a7a661474bc9511
-
Filesize
152B
MD52080186d6f5db7e3cfa005821bfbb7b7
SHA1747402499c74c1303864628ab62ad7b9f8cbb593
SHA2566a3f99064360d7e9c65236f857f07213c458ed2ea666ad7948aa514e0af20977
SHA5121e9ed1b8a799aedd5b460c78822811ae93098f6da012ae89484210c38bf56c4e8bd7a8a8980ab663556d9993e7a49f94617821302a7790df85aef017c7636dfd
-
Filesize
38KB
MD5a1cbc8600fb0e0b668df61bb5d1737f9
SHA165aaea9cf40ee7aafcf033f35980aac172b0a267
SHA256b0324009cc7d496245d763710959284dbc9eb3c4aa93227cd6fa82772ff5a2bb
SHA512c731cbc3fd2397fea0afdb98ad7e0a2624dfdd9da00da2032cbb425ff653291bd3e9290514d6aac2761923a055c0666b521a61524595c5ab1aa2b56ce18b2338
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize240B
MD5badae5923849cdd2435ae88d16f2826f
SHA19101ecda18635904294eda1a43566c53d8c166a1
SHA256ef164be1683216af7ebdfcf6d6969139aadd62c933cd8461fb35359a93f6e9df
SHA5127077888d5119c9b68d140be94bb63058d4650af6fce4c60272bf4d89133a190165e3cfa7c31bf78fddf66b20d546c0f7b99c1b4b005031fdcf9e42453a252b1a
-
Filesize
1KB
MD5d91de072d765e962d37abecbf43aee74
SHA104ef13c8017dfd33373dd62cd3c54e0456c68586
SHA256391ec5bbb6ac64960de92b511b93c3304e3c8b4d85a8488a4bcfdee060a4f526
SHA5128b009c06bbfb5c33a388b905087e66f50cf7675bd94e83588c77351a82852e8a08b839fc4dc1d5f321973a8b381c4455cc397d1205ea87f08663e8fe88dbbc69
-
Filesize
5KB
MD58bbc7362d93386fadea713c38c21aaa7
SHA13f0c73a658f4f7720b461954e03d14eb80ee81f0
SHA256f2e9670e8332050b46ac02b6e7afafd1cead0d6eb737c96f70da7ff9f581b67b
SHA5126e4cb8bc23c4c87d7aef287970294b66195738be206caa6e55675f91ee45bd0c4c23d7b9a01dfd028fd9390afcb6392590345f4b278155b7f6288247ef58413d
-
Filesize
6KB
MD52e1e1da12a4ceeebcbc1a5b32da68c7b
SHA1546fbd4b9a9a5b3eb72fdae5be291908860be479
SHA256d9e466d1355ccabae86d958bedf027939a1f16160ba77ad2974e570b401538f5
SHA51221a11dffa7787693825990fdb833d9e3f3f92839bd26001b7f4f000673afeb98f2ec4961dec8f86b0ed94780b31743dc5d3865c7be8722fa23b96277ef11235a
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD53aa7d40e8fcc0f1475f5b44439a50b9f
SHA14988a49fe394e47e917b614376d8d7eb8a7ebbaf
SHA2569d196be7b4f987d92e946988b35c360d1c49d36ea6ea0177902cc66ec2bb67be
SHA512200e58b913ac80e9a71255f0b1e3c73077fcaf23ff694a87d8c26b8c5b531c2a164ef540289924a370a36dbe6f6661e7fb202e618f0fbef9047c5e2dca630f55
-
Filesize
10KB
MD59991674ca5143350762254a6ea716147
SHA129eb183ffe7b97105fb283fb97493fe616c75e6d
SHA2561365595f3a23a30612fc37a25fa7a16a1919f144616c4d7327cebe34a97267bf
SHA5122477631dab032dd7d39d45874ebbac191c9f8d68c1f5f57fcfc2153719b5143a5c4c51ad40cf48b1497f0455b7382999a220ce70f11235e0db4be058f395e808
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2y44si8f.default-release\activity-stream.discovery_stream.json.tmp
Filesize18KB
MD5f2c6b5021b96f536317150f741a49d94
SHA13e0ab5e3687a13a9b9cc6a23927d530fe80ee121
SHA25616d915fee275694b783a0fbaaa720fbb19b05d5cca87e5cfc1ab6c1a30ceef03
SHA5125e98d25615005f461be8658482cf73936d3213c61f1f7d41a2ca74b2e87072989d9f423eda67a38814d322754ecbdef6417cf7eeef9beedd8993e11d5840b284
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2y44si8f.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Filesize13KB
MD5df0162949a4703ce0dd0aa290d904c6d
SHA10095ab6007837dd0b8f0e2b103b59c15c3fc860b
SHA2561ca8cfb495631265d18745289d1c9e19e543d15b44d3a8a5b45327b4d09373a9
SHA512483b6c0d5e14463ddc45479ea1ab792196770821ef18df926710f676968e7fc23d2bcc294ff8c2cb5fe63f7f34c2d3ccc7777dfbf2da5d8ae247ec6365c10571
-
Filesize
10.7MB
MD5c8cf26425a6ce325035e6da8dfb16c4e
SHA131c2b3a26c05b4bf8dea8718d1df13a0c2be22ee
SHA2569f7be9bf913d8378f094b3f6416db9aa4c80c380000202f7cfaddadb6efc41b4
SHA5120321e48e185c22165ac6429e08afac1ccfdf393249436c8eac8a6d64794b3b399740aa5b2be23d568f57495d17e9220280ed1c2ea8f012b2c4021beb02cbc646
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
1.4MB
MD504e90b2cf273efb3f6895cfcef1e59ba
SHA179afcc39db33426ee8b97ad7bfb48f3f2e4c3449
SHA256e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
SHA51272aa08242507f6dd39822a34c68d6185927f6772a3fc03a0850d7c8542b21a43e176f29e5fbb3a4e54bc02fa68c807a01091158ef68c5a2f425cc432c95ea555
-
Filesize
249KB
MD51af1153a0a58d5cd0679d4e744dfccc8
SHA1f510faad0689f0c346a687890ab4627e89524ea2
SHA2566ece427d5679c5bb1939246f2301cec7c64c4540abeb0c6baebcc0ae5f350633
SHA512955ba132cf5c653a74647bc1a31abdd036933988040101483f9dff11423c9e06588dafaf022f044fa909684b111c4a9843bcaffea408a7c18a5bca1265868731
-
Filesize
304KB
MD5a9a37926c6d3ab63e00b12760fae1e73
SHA1944d6044e111bbad742d06852c3ed2945dc9e051
SHA25627955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
SHA512575485d1c53b1bf145c7385940423b16089cf9ab75404e2e9c7af42b594480470f0e28dadcddbd66e4cd469e45326a6eb4eb2362ccc37edb2a956d224e04cf97
-
Filesize
89KB
MD5b95e20a48bc237090b1d624c6bf32730
SHA1678e81b52fb835a21c5d4f951020a8f395ffb924
SHA25637b7375232555b4bb0262d745b287bde1003733d16aef38706d8e4ed451e1821
SHA5126342a40886cdf1ae85d1cb0211526971aedd291f133f79d48f1ea9a44d0b264324d7aa8c71819113ab9aa164fb7ec731b60da1cf00a55902fc032ad072101186
-
Filesize
1.8MB
MD5c69d5bf045e03eb4e1e8558dafff097b
SHA1aa2510c68b98780b23d086ef69e0fb028d2cc791
SHA25611ad6a8a6dc60410a02d41d176225346ae7225b5775ce7b74f01a0ba924879b9
SHA5126f4d59b9d1fde6a33d7a8758a8432a74358d92dab57deae881035e2d182f4441e4375565858180d14cd8d479142f2734e91ebf07a75e312c011c988bb02d59dd
-
Filesize
2KB
MD5de9423d9c334ba3dba7dc874aa7dbc28
SHA1bf38b137b8d780b3d6d62aee03c9d3f73770d638
SHA256a1e1b422c40fb611a50d3f8bf34f9819f76ddb304aa2d105fb49f41f57752698
SHA51263f13acd904378ad7de22053e1087d61a70341f1891ada3b671223fec8f841b42b6f1060a4b18c8bb865ee4cd071cadc7ff6bd6d549760945bf1645a1086f401
-
Filesize
75KB
MD5e137df498c120d6ac64ea1281bcab600
SHA1b515e09868e9023d43991a05c113b2b662183cfe
SHA2568046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
SHA512cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90
-
Filesize
6.9MB
MD5f918173fbdc6e75c93f64784f2c17050
SHA1163ef51d4338b01c3bc03d6729f8e90ae39d8f04
SHA2562c7a31dec06df4eec6b068a0b4b009c8f52ef34ace785c8b584408cb29ce28fd
SHA5125405d5995e97805e68e91e1f191dc5e7910a7f2ba31619eb64aff54877cbd1b3fa08b7a24b411d095edb21877956976777409d3db58d29da32219bf578ce4ef2
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
112KB
MD587210e9e528a4ddb09c6b671937c79c6
SHA13c75314714619f5b55e25769e0985d497f0062f2
SHA256eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
-
Filesize
114KB
MD571055637532fd22db8a509dbc6b6a8b7
SHA115cf869ad1a061b90635895d057781924805e542
SHA25664ac8a498ceef3c66c3c66b62c0770f48b62038acd583b6a381e499ba80444dd
SHA5126bdb97e522a7abb6f03c9865457002141fa0e2f7f462828ac9740be73a5a0aa91987d91ad88ad04ecb0bb7088983d25315ccabfa2996b33da63bd9529041e6af
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
81KB
MD5a4b636201605067b676cc43784ae5570
SHA1e9f49d0fc75f25743d04ce23c496eb5f89e72a9a
SHA256f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
SHA51202096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488
-
Filesize
177KB
MD5ebb660902937073ec9695ce08900b13d
SHA1881537acead160e63fe6ba8f2316a2fbbb5cb311
SHA25652e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
SHA51219d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24
-
Filesize
119KB
MD587596db63925dbfe4d5f0f36394d7ab0
SHA1ad1dd48bbc078fe0a2354c28cb33f92a7e64907e
SHA25692d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
SHA512e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b
-
Filesize
154KB
MD5b5fbc034ad7c70a2ad1eb34d08b36cf8
SHA14efe3f21be36095673d949cceac928e11522b29c
SHA25680a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
SHA512e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c
-
Filesize
95KB
MD57f61eacbbba2ecf6bf4acf498fa52ce1
SHA13174913f971d031929c310b5e51872597d613606
SHA25685de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e
SHA512a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
63KB
MD507bd9f1e651ad2409fd0b7d706be6071
SHA1dfeb2221527474a681d6d8b16a5c378847c59d33
SHA2565d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
SHA512def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
28KB
MD5adc412384b7e1254d11e62e451def8e9
SHA104e6dff4a65234406b9bc9d9f2dcfe8e30481829
SHA25668b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
SHA512f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07
-
Filesize
1.4MB
MD5926dc90bd9faf4efe1700564aa2a1700
SHA1763e5af4be07444395c2ab11550c70ee59284e6d
SHA25650825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0
SHA512a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556
-
Filesize
18.0MB
MD51cf17408048317fc82265ed6a1c7893d
SHA19bfec40d6eb339c5a6c2ad6e5fa7cebc147654c5
SHA2561352ad9860a42137b096d9675a7b8d578fbc596d965de3cb352619cbe6aaf4e9
SHA51266322d7cb5931017acaa29970da48642d03ce35007f130511b2848b67169c1dd4167f1e5a31e5e1dfe5f7122846482bdb878b5cd695ac58009033fd620813a0f
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
Filesize
1.8MB
MD5443e95b6a5732f75947b6a4def6c86f6
SHA1dffd07507b3d4d9a758504d3dd1b0f832822892b
SHA25634534c44bf3ef4e864940a14e7a3ac79471743019f3ca4a4629a04c6a6cfe25e
SHA5125bc0da13c16d7627a5db8a207abb8d287558b714e796f853f5609a9d91948523158673ca80f86983dd9751331c1419153653f3459989a3eb49dc1969c7321fea
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\AlternateServices.bin
Filesize8KB
MD59dc708c360d711fbf44401d8afe511e7
SHA15f5f5b57f82e1e8e8dcde311c80747307934997c
SHA2561abc6826efe6575b5cef33037145fb27910df22d2f57c0a441b87b35edd81536
SHA512a8b29221e5d95949260f034458db1e816839e59d31bdc4d3a9dbb274e3d60cb5b9151d83637b9d40342f3e9351bf2e2c095b6a42ec37de6534cd53feb77c7b49
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\AlternateServices.bin
Filesize12KB
MD502b27f83efb9ab9a4f50a12031ae0cd3
SHA1ca4e7054041a9753aaa15d8a1c5b7acf6ea8e72b
SHA2565f34fc091cb69b7237958f522c238be6c8a53db221103edc265f2c55a206f3ba
SHA51257af9193f4b44415cadee8bf7b005005ad133d565fbe20dc8786c037801c2e650359221047b7f0a8a86536f186d1b1037a5f0602a0cd7f0d7b788c8996871622
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\AlternateServices.bin
Filesize16KB
MD50d25ba356ede0a677f57a1a518363af2
SHA18cae0732d7fa5828b7d255026d3b3c0779db397f
SHA2569712e0ce778dcc5696d6c5cf30ca7fe041f74216ea581ab2f9baebd6e3f2a0c4
SHA512a266277609bece208bd4b2a574abe81e4d045f8f3d165fa4d4e755633d70269360853c25d29e726617b77f87274637963f2eeee3a98f844c4d94d562a3e70c0e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\datareporting\glean\db\data.safe.tmp
Filesize21KB
MD579e9cf86da9daeae7a172acb2f1f594c
SHA1cd47b747df3538d905c42ef9b726013ad673384b
SHA2564f12c4f0a8b1a7e03bf014bbcf7d4280aab1a88590af0a13cb338507cb05b4f3
SHA5125044e60debfa4704f77c70030a84330963060b2c2ecae84e074574c57909bd0b7c9c7020ff06ca0e1e212a1b93f1c44569424f08c0968b0c491085a3381fed3b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\datareporting\glean\db\data.safe.tmp
Filesize22KB
MD5cb533f4f6eed55a4da149b116282446c
SHA1d0f23ca9940e5f55a2f75ecf22ae5a052910f9e7
SHA2563aa4c9bbd30526c1cfe81eb13523d805c68a98833218a4bc3ae9a732d10f262d
SHA512dab167903244d014c391d41933d58c3d6f1c7933c157a56f1ebe52affbd4b42809b263dd64bbb4c6d868ea82cbd00ac89e7dd2a48e5f156ec44cb59e6e37238d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\datareporting\glean\db\data.safe.tmp
Filesize24KB
MD5f15d2fed77868c8def786ebb17bb19bb
SHA1be7ca6a73afdebd8ec79982310d59e4ab46f4eab
SHA256c04de72dffc3c70f2d10650bf4c8627f91a620bbaaff768496e3b097e05608f1
SHA512265088bf54b4f3b40030eae083f56923a5f8eb90cf5a354c2f48a5aaa69729517827f236dbd324dfbe3e9a80432afef355b4cf8b3613e6981b5b6efd8c4e6788
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\datareporting\glean\pending_pings\1c2af781-bfb1-4877-a86c-a86bf8c124db
Filesize659B
MD572719d9e8209946da7464e6dcf57a8c8
SHA1a57ad22c19cb3b89eec8fe8d71977b8861201db7
SHA25640128a38b3caf5f6aad24f0a1075247bd1a5e89d584381a66f7654570e21a25c
SHA5120a753bf76d28ff6b6048237325052537874023cbf6c40e3bce72000466a1ea660753ff91363a1efda2481de67ee6338e55978a6c2415eb58ce89f81944b9628b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\datareporting\glean\pending_pings\376e6a45-3cb7-4fb9-9519-797451286bf9
Filesize982B
MD5e045e51423c55cab8ec3b1947e67e29b
SHA147de562bdf6267e2362173d32c3bdef911b5f3c6
SHA256855b80ff504b3be686691d3df23ac13418c4ed3d07baa5466cf06abf8fa84af8
SHA512b4da0b23e0b9077861f1ec26540cd04ad953d8c776705ae740da0ec20a0b07e9fcc39efd91a5cdcde056dae05f5bb3eeb2a4f3f54c8ba2ac3ad83eedad7c14b8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
10KB
MD5ab1a49f48d8dc3f20f51cb5886d3ae14
SHA1f5981fc2159a5d8e7b40e9bcd3d8d5d15aab8d93
SHA256d738b46f285f311bd545b9bac43b22e2f1db4341e32da4645c718a816bd0f8fa
SHA51290da6f5e8a1a6bc0a70fc6114288274f40c55caf0aabdfdcbf1de11ef233b353f3c19faa134395de652f9bd8302f97a6004969747e06a1da5450c65cf6eb6de3
-
Filesize
12KB
MD5e30f882d2cc201505d7780f0e049c704
SHA10543888fc88aa651b68e5f9849bd0dcdd5f915ee
SHA256d9fdf29c24ab572f794d2fd7c7b7c47e848600739139459332ff4d18a51b9b43
SHA51242477a89a4d2c4c428c43a78499825a477617747153b84862fab3dd1bdacbeed4f484707fd1589bcb1e69804803a24b311114b71b111096413b161f64467c1a3
-
Filesize
15KB
MD534e429f76ab9b57b517f27c840851ff9
SHA1ba0b66b830e515618745e52ccd4b912eb7326cb0
SHA256b430c292ed8a0f3412dd758a4764edf51559f39fe7c17197fb807bf0da3c6588
SHA512549718749aa58a084566bad8ccc52a2a39df40bead170fc5c02245db908d2d437333191a568727b46528fe54dd30f7def209a3e848a538afe97e86b000a8ed2f
-
Filesize
10KB
MD5b08e25b7af89bba1da8d3035de84fe07
SHA1ec291ed818cca02f0691757941440d0d47909884
SHA25606f623f2a601e0a80060eaff732ee1721b913514c32cb41ba84e0cbf3b9ddd00
SHA51225f01c61543162e5922c4ea13f304cb81b3731df5f7b8e53989be1ad0277c7251900916a6395b613c9837215d2e9048fc1fe5bd6929266b19d401b658fa02328
-
Filesize
10KB
MD51423c2df05f040e5d283e2efbedc45a4
SHA1bbfc83558c5c953f3b4a66632840e992285eebe9
SHA256eae8ef1e0f451e1554aff9312113391206e4601b1e65afafe5e90833b44cd226
SHA5123744a1c7ea31638b67bfca0cef5406c4719624588a9ce540efa0e077d39f3e4032b63a44a23a8b53271f897e133700814492b586c2c7571040335ba5b87961df
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2y44si8f.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.6MB
MD56b666b8cb5190c629aa3fd3390f336ef
SHA168e5bd9f87f694e5be0b6322de01042ec85305d4
SHA256f83dfd3aa2371553ab06a9cd76542fbd7df5057e38c680930910b3b74bfdd0be
SHA512a68f49b16dfd5ed275b181dcc659f3384c650ad13f6e4779cc76c3148fe8a8e8039bef3f687f690f555461d750545424f5a5fc3a4e916b9fda492c5ddd4d44b0
-
Filesize
510KB
MD574e358f24a40f37c8ffd7fa40d98683a
SHA17a330075e6ea3d871eaeefcecdeb1d2feb2fc202
SHA2560928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
SHA5121525e07712c35111b56664e1589b1db37965995cc8e6d9b6f931fa38b0aa8e8347fc08b870d03573d10f0d597a2cd9db2598845c82b6c085f0df04f2a3b46eaf
-
Filesize
503KB
MD52c2be38fb507206d36dddb3d03096518
SHA1a16edb81610a080096376d998e5ddc3e4b54bbd6
SHA2560c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
SHA512e436954d7d5b77feb32f200cc48cb01f94b449887443a1e75ebef2f6fa2139d989d65f5ea7a71f8562c3aae2fea4117efc87e8aae905e1ba466fbc8bb328b316