Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe
Resource
win11-20240802-en
General
-
Target
256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe
-
Size
89KB
-
MD5
6cd6f581096153b6f9e38e75262e2681
-
SHA1
a5384c118bb1ac6774694df86b53f7b09f10ce20
-
SHA256
256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d
-
SHA512
4a65b06be0ccc06ac6dcd2ae1beb24adda77e45e1ee9cdac9ba6fadfae4345597b2dfd0397b311521b01de52623eb714b6aaf54e38feb646459337a2e226c5ba
-
SSDEEP
1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfcxOKeO+:Hq6+ouCpk2mpcWJ0r+QNTBfc4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133685755636405774" chrome.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{40BF29C4-7232-4630-A0A9-51728A66BBF2} chrome.exe Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3448 msedge.exe 3448 msedge.exe 3080 msedge.exe 3080 msedge.exe 1360 chrome.exe 1360 chrome.exe 5420 msedge.exe 5420 msedge.exe 5420 msedge.exe 5420 msedge.exe 7032 chrome.exe 7032 chrome.exe 7032 chrome.exe 7032 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3080 msedge.exe 3080 msedge.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeDebugPrivilege 3200 firefox.exe Token: SeDebugPrivilege 3200 firefox.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe Token: SeShutdownPrivilege 1360 chrome.exe Token: SeCreatePagefilePrivilege 1360 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3080 msedge.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 3200 firefox.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe 1360 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3200 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3676 wrote to memory of 1152 3676 256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe 86 PID 3676 wrote to memory of 1152 3676 256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe 86 PID 1152 wrote to memory of 1360 1152 cmd.exe 89 PID 1152 wrote to memory of 1360 1152 cmd.exe 89 PID 1152 wrote to memory of 3080 1152 cmd.exe 90 PID 1152 wrote to memory of 3080 1152 cmd.exe 90 PID 3080 wrote to memory of 2536 3080 msedge.exe 92 PID 3080 wrote to memory of 2536 3080 msedge.exe 92 PID 1360 wrote to memory of 3064 1360 chrome.exe 93 PID 1360 wrote to memory of 3064 1360 chrome.exe 93 PID 1152 wrote to memory of 5016 1152 cmd.exe 91 PID 1152 wrote to memory of 5016 1152 cmd.exe 91 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 5016 wrote to memory of 3200 5016 firefox.exe 94 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 PID 3200 wrote to memory of 3908 3200 firefox.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe"C:\Users\Admin\AppData\Local\Temp\256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\84D0.tmp\84D1.tmp\84D2.bat C:\Users\Admin\AppData\Local\Temp\256260d495d11a8384c745c68b0a4e8b3a003b4de6751a66a6bf9ec590ba854d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd"3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd8c93cc40,0x7ffd8c93cc4c,0x7ffd8c93cc584⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1916 /prefetch:24⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2176 /prefetch:34⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1380,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2568 /prefetch:84⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3136 /prefetch:14⤵PID:6064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3344 /prefetch:14⤵PID:6084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4576 /prefetch:14⤵PID:5364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4608,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3692 /prefetch:84⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4416,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4748 /prefetch:84⤵
- Modifies registry class
PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5192,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5208 /prefetch:84⤵PID:5836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5248,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5256 /prefetch:84⤵PID:6176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5440,i,12094178111212755549,3781091483010976938,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5272 /prefetch:84⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:7032
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd"3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffd8ca946f8,0x7ffd8ca94708,0x7ffd8ca947184⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:24⤵PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:84⤵PID:800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:14⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:14⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,16055067733397178591,5869334262949143904,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5224 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:5420
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd"3⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://accounts.google.com/v3/signin/challenge/pwd4⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1920 -parentBuildID 20240401114208 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dcaca231-5197-4ddf-b57d-3ec73d831101} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" gpu5⤵PID:3908
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da028b75-7f8f-42d4-8ce3-0f67c9c2b196} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" socket5⤵PID:3888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3292 -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 2844 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f0da532-8b0b-43da-863d-a55a73463ab4} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab5⤵PID:5004
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3688 -childID 2 -isForBrowser -prefsHandle 3660 -prefMapHandle 3228 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f894053-81ae-4e38-913e-cfcffb3666d7} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab5⤵PID:1728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4428 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4424 -prefMapHandle 4420 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {245e8d4e-7b07-486a-aca9-5c9a8e911541} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" utility5⤵
- Checks processor information in registry
PID:5872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5372 -prefMapHandle 5364 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {21b17a70-a4d7-44eb-abf6-ce9c8ff5ea71} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab5⤵PID:6000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5360 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5532 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d808883-728b-44be-9a01-45be639bc964} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab5⤵PID:6096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5808 -childID 5 -isForBrowser -prefsHandle 5728 -prefMapHandle 5736 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e21e31f1-791f-4ad3-8c0c-84e04b38332e} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab5⤵PID:5888
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5916 -childID 6 -isForBrowser -prefsHandle 6104 -prefMapHandle 6100 -prefsLen 27182 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84f96005-6137-42fc-80ab-b87926698227} 3200 "\\.\pipe\gecko-crash-server-pipe.3200" tab5⤵PID:6420
-
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1864
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4156
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:5684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:6340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD50f1462e53c2f6af521a1a108dce41b0f
SHA135719abda1cef1592079f123ee75e47d2f23a743
SHA25626231b08dfd8a0306616afdee50aa5921d6135ad09aa59b858b5495ffef224f3
SHA512f25ac0caf9ca73d06e1ce9902b4be5b9514dedcb253818cdfc862bf487d0feb410bfc40a97bdb17f3a6879bca7842a776a927ec567afb771ef1c277cf2d71711
-
Filesize
384B
MD551e750cd9e2f03f7c6dccc4df51d9965
SHA173476e70b3ed25605534164e44b92a2cec9e5bfd
SHA2569e1303a97a43f913da073469c32ef11de06a752520bc49a66499eb1111f3f2ac
SHA5121c8563cf72ddf883dd15c8cca61549590841625088a3b46bf65de154f03c950065f59a0d25be5a55afdc8aa3c4e971fa259ed9c1a7543d178198c272ecffbcfd
-
Filesize
2KB
MD54ebab98fa3d52b43aa620565904e8134
SHA19eaf93ba96297124ce042e51891dfee797aad820
SHA256a454140b865530077ae6caaaa21044b1f81c1b5f17adad01d3b2a458135dae77
SHA51271f707ad3e635c582d746e3cfb1703ef56d79dd9c0b0e99cd015b87bb651b4099001f3aac6f90aa12cba7bb542ca91f8d6303bdaa93a04c5d4763f7c0af73fb4
-
Filesize
2KB
MD5e97bd0290db7e803937b234fa8d82929
SHA13183e4a2634907d76163190bc55a466826276715
SHA256bd3006a33b873efa47605fd385633d6eeac1fe7c7fb69b9c66c3c67dd62f80b9
SHA51299bf5d1bee034db783ac313025ab0f014a073787087b28cc322fb8cd64567ff739a95a47815bc7fcdb0b13bfd8e784e14486c14a17f9ff25e11ef95dd33eb79f
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
354B
MD5818c2e46804f321695f204be64637721
SHA1a8d6d9b36184ae6e8c359bfc2660882af2b2887d
SHA2565e10eef5242c07b84b562983a0631535630caec3e48e40d10bf6ada961f7b3c3
SHA512a1f9270cbf63097e7d044828da9713c147fd9589be32d90d9516e1cff3dd0232d51c719ae9cf9c7f79b71b63141ca37cce81c3ef229e9fcc7d1b9c7d78ddd5b4
-
Filesize
356B
MD5393d2620560c2ef0b07809247980bb70
SHA13375710b44aecda0a3a6ec3a3eea722fe91f3f96
SHA2563245540f25439d08f95d9f0182c74414d76894e6a9be19397e59a2f74444326d
SHA512dee87ed2cb4aa76399283cd9f0cdf9cb205689e22a84d6818509011bd12ab860f923380a1744d400c1c59a236f13ded915d4d1693c09024bfbe58351d8124500
-
Filesize
356B
MD53a26e725d38a7260974a2dc26bcf28a4
SHA15abffeea0a20097a8829a9e8154c376ffe0d4ea5
SHA2568a58611424f3c907bb814dfdd937c92f87448d4a95bfcf4d34451998b725ddd0
SHA512e2a499021a86bd19cfa241e59355856651afc50c9e4b4d6d2b659ffe0c88495522d2dc2bc663750fd3e667a6898c3c6eefc84824d9380edbf870e8c06cb4260d
-
Filesize
9KB
MD57d1046247df1f238903c200332a99795
SHA14da6c0050496b8c33c51b8c86b2634014e2a2d20
SHA2566a5adc62c0ebe4caea7d25c97708e87fa969a0c8f8db3746a4859bc6e978a69b
SHA512074d85bf4a3ed540dc87e01a25c22ff493cb9702c761bb927bef9abe77210dce82613b1735be023b9566dd5dea4372be346eb1aa610853d394a9a78fe227e472
-
Filesize
9KB
MD5b3b362b803feb292d9019281b4842b0d
SHA1b775a3d32b7a8ebb1f67fede64be28ceb06ef0d1
SHA25625f7f3fdf9d1586a6be5c9dfebbdf92bc8f46b85315406df60b0280df8835846
SHA512653961cb19389d9fec0e29172728818d3a0d66ef3b1c8b56d2b329a288fa8915351f0bebf260b7c5fb12b60b266b243cc108e7a92a716561b791ecfa14f05f88
-
Filesize
9KB
MD59047f911c906ab9d8ff92cb7265f805d
SHA17ce4d6b8d46a9f16acc336d65c689764997450b5
SHA2562fcf0d53236f89fc9fd42eecbd96149755061a1b35b0547e6d390eb7b1c0b4a9
SHA512dab7207cd342d4354c1e59248f5848d655c4306c64a9a4d6a5b805dedfcde158dc690363f6e1257dc1deb072c4fa583d7b4064b5e1652d8131ab427ee1bd2694
-
Filesize
9KB
MD5970db36d0c63f61fa84dd9886d4eea81
SHA13c8eb41cd63685fe0f5f02b37cbba880b6d8d7be
SHA25695741c583761350f92aec37a70701b4a29d95303a6fdad4915aafc1c0e927b8f
SHA5127bdaa6f0a43cad119a05d8ebd8c05f4d4b5c479e543870f1d1f2019d73cae6a239417e21e8af479db54effaed91912f5a18a413deddfab0adb016b739b23b39c
-
Filesize
9KB
MD57e6d2220248285cccb08a88dfa6e5853
SHA16d09199f206e6d90da920f51dec7244f0a571b62
SHA25684491372c02ca90e9a0ec3463e70b97ad85db23a933c1cb6af52fc9967670855
SHA512578bf2fa0e1b17ad5b36112197d09fa77a929b3e379640c0a7dc17d021cdfd3704fb34e70fe8e7d525ffaeab22f886838266a12ed0ebe7ea57d66778b36eb33d
-
Filesize
9KB
MD5a7d7cb6500f56353e58ee592cd3307f8
SHA167a855c23a95aaf567d9d61a0835a799d00932fe
SHA2566d9d5d4e538e2676dd01d45534ba13bafe2507ff2cc88e8872579840bc87577b
SHA512c76ed8291cfbd5bd3af9d71d1cdac3d9ddb665b20370564f79e5ea46da1e8410607c2a19c6c2de1ed3d7982e5ca70fec071bab187646436328d1f65ec7dc8fe6
-
Filesize
9KB
MD58dfc908efefb86034d48ed3be6338cd2
SHA1ca8d45e0efdf996d1009692b80063ff263728d29
SHA256de454657e5f2c35bbe0baa42b59f398b4a7dccace9221bcf4d11b74b33ff77f1
SHA512fb8e5679ba83bdeee95d217e3e16a86b601962dc6cf077375267052ab52fb9aa06ff070738b77b6f6c2a96accab387ba0c49a07bb09c47f78e697c29f06ce370
-
Filesize
9KB
MD50b190f638f8e8eefe6ac6d826e34f2a7
SHA1cc0a697ae03d938df9179c9f4d14eeeba5db6e69
SHA256edccbbda31a98e4b10e515e423fe2166156ba6fb8df09919b856b5920c760b14
SHA512abe0dbc1b6f0909e012f9ad4df7873c8d0917ad6555f93ec9baf1bd7d25a21f7d068894863f09d961d41a8eb6c7e7bd03536323e3ecee5d837ad08e3a0e7cf20
-
Filesize
9KB
MD5f3ec23636ff4bf32c7d131a2749c0851
SHA15ddb3d98e6121771bdad3d5970f519dc6c54347d
SHA2563b0ec592343bfcb4716a92645b99ecdfec701d99830d82ee5552571c31be04b6
SHA5123bae05769438f83d78cee3cf8aa26bda88b20c32ab0d3811f41cc5cfddbf980bcc391bf720a5dbf91462da14dc67ae06088ddc06992dc3bcc17196f70e764d76
-
Filesize
9KB
MD5a91c6ea49d9bbf242ce4dd2e5ca3233e
SHA1e6da531cfb734798f6968d9ad8df7d0020488386
SHA256ce43758eb38ec74a30d1a9a875be2e5b013a5606cf77064a6e836ad3638cb083
SHA5120194aab3d37bbbf992c7fb0a1470e0ee8c5fbfb64d73f69655b7f1899d9ad1fec7387f1ac2bf6a04aac3e10154a6108871bd668000ba3e8f197ab17b985efbb8
-
Filesize
15KB
MD5e6dda4a6c7183f6892bae40b6adef1d3
SHA188f6727e8e7e90710eebfb3c02cf49899e3eb594
SHA256617b4d1f24f228a7dbfec454dde1afae790a61f433a8e0a0db36f8d969781e8e
SHA5125f8a43a4f455b8a65156cb9a34f1f41509f496267e5643c81a1d358ddc3c8f80e994df90aa872e84c305243b3aa54abc592795637bec4c206e337f067ea067cc
-
Filesize
199KB
MD5989b533f9802f94a310f1c9144cafa9e
SHA193b99c78140e58d99c4f5265bcae5eafe6551efe
SHA256f26cb13ce9fac64e12a8176595020581b430d13da24c31cb17d4632e29f6d5cf
SHA51298cd5df56088f2204e1d5ad771a3f77b8d67bb9e6368cd6087daedc38868957c2ac19d3589ade3b431f2e32b970179b9952f62ddef4e19915f8af80abae91243
-
Filesize
199KB
MD594ac06fca5ec68486e015ae868977fe7
SHA1aa07c6b50a52341b6d490ee3e84120659f7794ce
SHA256ebcf65ede211816385e32384ae4385ac741a1a9eb6e25dc785cd3025bda78975
SHA512e50af5ba2a0938429e8cd958af943288e7826e335def6b5d01e8d726933271ff8b6440840eff901da4d2e1eddc2555ef7ef791c3a9addb381228e6888779a622
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD5424ddb7de714675208e204149dac9bba
SHA1b6c720492d313fcfa1a8ced63fd0a6548f6c5ae0
SHA256b67947ca316a6d351b0e9518788af93673011f0867b6fc10fdf0a63409fdf88c
SHA512e4e1d1c1c7c449cd1423ba3f8e178d1fbb06a0204fa2364372806cfa513ecc08745a32ef1b4920d6eea0c98ca853664a3fb06172340e239af8f70702405e833e
-
Filesize
1KB
MD5a5e17c98d8dd52744f220d4a9504f822
SHA1687119b73be12a57f2c0a6892b400c2cdec6f94e
SHA256d17d447983b99c264cc79bf6f11b0ee301639bbf2e871b7ad3ad3a048b3e42ba
SHA5124483dc7d358a1b499f3491ffd65d7587e0a769d0c2db65386e739daaa73eb486981eae21ca3f215bfc26de4de69027dbd0fdc932285db14906e32ec0ea35b20a
-
Filesize
1KB
MD5b0e1c79b0bddeec55c544332c01abfaa
SHA1e516c8e9430a48da1538448c664e405aec417c42
SHA25614cbe19a1bec35907657294a37c40365f4899cbdf099781c89d64b5229813aa0
SHA512661f15d7b6eba519dd4d9b8ec5090d25b5f769b46d1f53b4c8e497e923278843d25f4ba323397c6dea0f3edbb71f227382f3e074e0182a5afdce54d1ba62760c
-
Filesize
5KB
MD5017c877a1bf2624820d0f911e11ac4f1
SHA103eaaf7264e3c15a7ccbf093e14d601bb5e69121
SHA256328c63537337f3301a174fc9e498c7893bc111ca5ee6ef78b2e179f26c953de4
SHA5121781c04b19038808b243207897c1516e9f98bfdaa80ab9bd2371dcb98222d2f416bb2001e81b777a0f0abb43212dda6ff24bf0f4108981c63ca4f42fdbcf10b9
-
Filesize
6KB
MD571dfec119b6b5f7e5bb2df803b9182e8
SHA167c7e8ae91d89f48e3964487a6bc0e0009d39cac
SHA256c97f791ca2735930666897ed6d7f98445a5d8029bb1a3e94297547b0c50f06ee
SHA512e793c9424a154843eaf23dab5333f0c430acbcf999a3efd51f374822a1d0963e61684cc17fe00ea4d4cfdabcfc3c99134c6746b97f24bf84168614d229b6a438
-
Filesize
203B
MD5e07e620ae5bad77a9d9189dda36b69f4
SHA1f8dd2cd5f9e424ae2fe43bb1db3ead7254d558c1
SHA2561e1d259d29b2afd7414e256de281ca3896af98d0c7c22d970f5b1d50d2cde488
SHA51267d4f3db268d1c6421ecb6080b9465b822a14b9e6402fad2f19c16259a0dd678628293b2b7b677e5dc82406d3ce622d02f039e24fb560b0a289de0f0c9b67371
-
Filesize
201B
MD58d0edd5bdc036483287dd6b0d0593450
SHA1528c8c04f4169d6bfd4eae7715bffb23383778da
SHA2564d0ffb7520958be5402ce177ad887b92400c93ac930c1acfbbb231199adb553f
SHA512d7363f01f3b0e5521de8416065d5a47994d93e7a92195e0c080d608dd7e2a49886f8de006e37084e1a9d90639322e750fc5e271f7f6e1c81942230e66255f33a
-
Filesize
203B
MD54cd7f33f1cefa5c37e9d79f93cc43bc1
SHA191db1d3dbd8ceb763dc148a731e4b2d8d513e1ad
SHA25608da2cf95af29f36abc874eda287764830b49bde496a7c0a3e860674190b1837
SHA512739117378abde6b9874e0d3fc928dc12ea5ee894d698eea2e2d7437770210ec9762fa1addeae2d7ab90eaaa8b712f09cdc38bf443a8317231dbfbbe451f4b57b
-
Filesize
10KB
MD5973ce1503d10364c0fa3ca473a444751
SHA1bde5be0fca7e5fb1b626563d35a3ab23fc187b55
SHA256b161dab8ca3061166be2f7156f832e3bf8523f1b3f80038e04a49e4619e2a20f
SHA512cf9f8b56c8d0a0b520a8902770d655418a62cbd92ff9592b62f3489bfbeed165da6d0022706db3c2cea82d1eb3895ec500a247825dd86ee917f7f87021f10db7
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\activity-stream.discovery_stream.json
Filesize26KB
MD55b72a0a4a6be3a4327aa3fab4d4d0470
SHA1eca100cb149e3df27137f930b1ad24ba66ba5b2a
SHA256198a247bc992204ac10ac05dfb27e2e1e57ca5585e2efe638d59fb6ad526bc3a
SHA512587b3baf6f685507b69b1e14a9b186e90256f012c94513b03648bb8ffca3353e775547759b7674a1b5024dd2890f04f33fc37ee385e867ac2fc9087fe881de1b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\cache2\entries\E449899591A9BC91DFBA673EC0589B51E541A88B
Filesize13KB
MD5bdb9029c64d762a979f161aaa851c2fc
SHA141aa08b4829284e892cd9aba4d18a5da9e26c89c
SHA2567cdf98c6fd898ae233bf9869930d562db88129ed62ca988fa396e0950991607e
SHA51253b9f57cd3a58b139ca941f4fec34eb3ab3f47750214b3b7095a3ef93705eb4a58368d6facc7da983b19488ef8d8d3b274bd74324a710663cf78fbfe9ac28924
-
Filesize
2KB
MD531c09b550c61042384ef240a1cd226df
SHA1731fbe63179f646915f8fa37ca9f8c85fdb9b48a
SHA256752a176e12900c9f3cf947bc36d506e360f86da00a2dbc1e5fa821f2584c75db
SHA5128fcd654736e4b71765b5379c6e1699771e83c5c1df1b5e3fa7f74e4d3b5629ffa1f54aaedfdf9979416d3704bcfb38d73dba7c36c7b6f1ac9804737e7af698a6
-
Filesize
479KB
MD509372174e83dbbf696ee732fd2e875bb
SHA1ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
-
Filesize
13.8MB
MD50a8747a2ac9ac08ae9508f36c6d75692
SHA1b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA25632d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA51259521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin
Filesize7KB
MD5cb9148ca4acbfa48de90ba686b19967d
SHA1acb46c81229b62de18ffa4c41a22f468e95a3211
SHA256bfa7b7974448e8b2c8416b7c75630f183a18f5b97056e09a940fb755fca9cfe7
SHA512fc066bf6890c5a1468ab5602a93ab7f99a34d06ac9ceab44a4fc26b02fa8e5f503bb4788951491ab648ea38b6dfa0edfe8b0562ed4f5fbd0f4028da170c2edf8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\AlternateServices.bin
Filesize8KB
MD53b2e0a981427b6158eda23edf53d38f6
SHA116559e6f52e6d8c2ac900cb1b9854ed9a53f2942
SHA256bb328f86e3d8c3cba1d5705cd6403c232af8eb8f72c0c7d5dbf10734adf0fa07
SHA512d99dd148b95324e528855b1d06f88fa8c1fb2e7e2a1ecb35b117bfd694bbae5811e2725e74673c05d660e55aa5c4cc7d3be3a587b5fe2ea6e52a5cbd8db26642
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize6KB
MD524c5261fa9ed0b06e7c889bf13cd6ee4
SHA1f81d7271858fb3b90ac1969fb3e30e8cb0c28ae4
SHA256ce99e87358f1f6b0633d993ffd1ad78a1181e310e83d47c3d8699e08ad92b019
SHA512c519fa394c35bc2d79694c1039e4331650182bb25ce8b0a49fa6a2a43072ab31ab4c9531eaaa54e8793c8354b46b52c53994fa8ecd103704ba8ca83578fc0377
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize5KB
MD514512c6561eb7d1b57c6cb9a831cc89e
SHA1619656229a34a6d3f3770a0f9d28f6ffea08726d
SHA2568efc12ad7da1b908c13c1eb31672d64222a9a1125e89ce4004a3ed77a190cba7
SHA5126fb533af45764fce1e0f8eb5da40681f5e5ea7c621e27fe01ffd322d9ff936f031683892ed50b28eddb58efe9a39ff2747063a145e445908bb7ab07959c0400d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\db\data.safe.tmp
Filesize15KB
MD5ecf86d762d9aa90d0b8f65c27d2828da
SHA19bd639c8e6977db54f385205e66b65211f686de1
SHA2568734148ce8e3c91fa60e636dba97201f33426dad59ec210eb43cca299d018964
SHA512fe111b3295a8d10e8e7615826760492abd3d7ee1e25a4837a9fe484444e8d72b1e905a959c563db968c06768a65fdb0d323c4a6a01a6fcecb1a92d4b55c520ae
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\35817f6a-a4b0-4508-9b63-50108eee135e
Filesize28KB
MD512cf1f8ebd1e64bfe67607d7052dc687
SHA11d563ddcebb34322002c861d94ada13fe73cbe7d
SHA256bff218d9b965cf9a7b74df2595fc40a5ee07113323568c8fd18d55a7e2dfdfe9
SHA512d96339ac72f90caeef2f508b3014000a7cacc2e9095010e2037a0b520d16067de001eedd46c7c1713ae4226b843f64a18702944b7549899d59d00de5cb3e243e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\bac67e0a-91f4-4d90-9a5f-642e0faa6e48
Filesize982B
MD5bab9ed4f78d423df5ac55a17b1a0cf7e
SHA1da5de8a4d87d32f655d97d467c2a24b11bc05556
SHA256e56ebb818bc40c45588ba54ef42cbd9a213553d41dbe715321b3c5dccb7982c9
SHA5122126c249f72620e6a724fcb3a07252b24daa9f62d769d536ae2d23c757725b4e84567cbcd720fe43e5ef1ebacf5880e5e284b0f8daefbbd8859366ceb9e71678
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\datareporting\glean\pending_pings\faa2ef2c-b7eb-4374-a230-90eacb8c332e
Filesize671B
MD5d9b7b626939125f06067e5ba21fc1ec2
SHA1fdbca4beb56376f15c6b744108ac0a29f583ab42
SHA256777cffee7e6ba657fc42e0774e04e13ebc7962f8a435c035d9825274cd968937
SHA51215a9cb1f21ecba03d76a487d4dd3b21b07d7640a5e3f783d078596ceb5d73a255d3e31d490fbd0f8a00d214ce32e5a133492d72ecb24642a9e1fc5b743550fa1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Filesize1.1MB
MD5842039753bf41fa5e11b3a1383061a87
SHA13e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Filesize116B
MD52a461e9eb87fd1955cea740a3444ee7a
SHA1b10755914c713f5a4677494dbe8a686ed458c3c5
SHA2564107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA51234f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Filesize372B
MD5bf957ad58b55f64219ab3f793e374316
SHA1a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA51279c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Filesize17.8MB
MD5daf7ef3acccab478aaa7d6dc1c60f865
SHA1f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA5125840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
-
Filesize
13KB
MD54c91dd79acd9d8857dd9c25ce230c831
SHA1bda309aca409b1cf364d11e1784b7ecb74d77f5d
SHA2566c0d7c6bdfea78facb42bd6412749ff521ed611fb9c2b9471f670f4b07abd714
SHA512203c0b6bd452d56b45bf7c9872d1edcd6f54b7d36d5f28bf82eb052c7a7d9e0a8b245be8e8e388d0101042782a9fa3ec288a0ac189fabbbdffae4e1d8eaa83f5
-
Filesize
11KB
MD5feef9d94cb1864ae8d5fa337a87bf7d6
SHA1c51ed7007d32354f3f256f2b4dd4bbdadf502bb2
SHA25623ccaa5179bed2ed8ea60cd801fe38f681238a40e8661df9c77020eaeb53705d
SHA512f408c60c9a52eb51cb7a3e9599d1bd28dd880608790ba01abbc53afcf9147df90b6c7834551c578b6c834e24c5365cd6683a93c71d838f0ec9832e6989dd149e
-
Filesize
16KB
MD5a1da92a5f1c25e02e6c47cacfb6add72
SHA1fe84b5d93f441eb1d4e4e1a945dcdc27f3d70632
SHA256153b5bd1dab7671bd4ee466f9adbf8767c07ddb91124898443d0852903074e53
SHA512cf05cd6fed7d2dcbbf7afd72b112092a6ef574afaed3a195dc1e940c581e11f3c3224d72a3032a84a0a0c0104d8afb72c046c612776055d4c6d360d6eb018fbe
-
Filesize
11KB
MD57761fbad24914d88ea2a6e242a486415
SHA19db879df19260444fc9224a818cfbdca9acfe1f8
SHA2562c9f3cdd53a606162d8840ce718be4de7dabdb05e9ba3afad59c37f342089708
SHA51278de368090241679293a671c4309a2d89bd73b3494e4c79baaccb8c06ae38df589b576cc6694487e40f44dfc33010f1d334dd30287fc0a0ccc68c8ee9af63fcd
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\sessionstore-backups\recovery.baklz4
Filesize5KB
MD5ea8cde4808f5f6040476503eb5f37804
SHA16005369190ff7716337b8b99db1f291de27dab89
SHA2561366c0e85312388b51919f6757ee8c5f46e22cfa3ec3be7d1fe0a149a55fc5c8
SHA512f396c8707dc0ce405564358187d52e6ee378ec23714aa3dd25921ab2b8cfac777884e4a311bf715239975a17b57747c85f0a41367dbd26065284a804e4491a18
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pj0o4bl8.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize1.2MB
MD5d2e39504e82b4e9f9aba2f063a329d3b
SHA158572dfacaf956baec282630590e9232bcca108c
SHA256bde722db9f680709d1e0fba356d446a58a6133267d4f6ef33df3ee856250edc8
SHA512035a64b82f0a9b3adf25247efe24b4a620bae05f5f2763fa060034d16f8361889411a2e353e68a275d5e42a93f50c5a85845bbbfe47d4c56ac88188241b789bc